Free compliance framework explorer — browse controls, evidence, and implementation guidance.Subscribe for updates →
BETA
SOC 247
ITSP.10.17198
ISO 42001soon
ISO 27001soon
Browse
Ctrl+K
33 controls
CC1.1
Commitment to integrity and ethical values
Control Environment
6 evidence2 controls
CC1.2
Board independence and oversight of internal control
Control Environment
3 evidence1 control
CC1.3
Organizational structure, reporting lines, and authority
Control Environment
3 evidence1 control
CC1.4
Commitment to attract, develop, and retain competent individuals
Control Environment
6 evidence2 controls
CC1.5
Accountability for internal control responsibilities
Control Environment
3 evidence1 control
CC2.1
Obtains or generates and uses relevant quality information
Communication and Information
3 evidence1 control
CC2.2
Internal communication of information to support internal control
Communication and Information
6 evidence2 controls
CC2.3
External communication regarding matters affecting internal control
Communication and Information
4 evidence1 control
CC3.1
Specifies objectives with sufficient clarity
Risk Assessment
3 evidence1 control
CC3.2
Identifies and analyzes risks to achievement of objectives
Risk Assessment
3 evidence1 control
CC3.3
Considers potential for fraud in assessing risks
Risk Assessment
3 evidence1 control
CC3.4
Identifies and assesses significant changes
Risk Assessment
3 evidence1 control
CC4.1
Selects, develops, and performs ongoing and separate evaluations
Monitoring Activities
6 evidence2 controls
CC4.2
Evaluates and communicates internal control deficiencies
Monitoring Activities
3 evidence1 control
CC5.1
Selects and develops control activities that mitigate risks
Control Activities
3 evidence1 control
CC5.2
Selects and develops general controls over technology
Control Activities
6 evidence2 controls
CC5.3
Deploys control activities through policies and procedures
Control Activities
3 evidence1 control
CC6.1
Logical access security infrastructure
Logical and Physical Access Controls
11 evidence3 controls
CC6.2
Registration and authorization prior to issuing credentials
Logical and Physical Access Controls
6 evidence2 controls
CC6.3Role-based access managementSOC 2Logical and Physical Access Controls
Official Requirement
The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties to meet the entity's objectives.
Access is assigned based on what someone's job requires, not what they ask for or what is convenient. When roles change, access changes. No one has more access than they need, and no single person can both approve and execute a sensitive action. This is where many teams struggle, the RBAC matrix exists but is never enforced consistently.
These are typical controls and implementation steps. Your systems and environment may differ.
Typical Control Periodic user access reviews against RBAC matrix
Implementation Steps
Export the full user list with assigned roles from each in-scope system (AWS IAM, GitHub org, production database)
Compare against the RBAC matrix and current HR roster, flag any user with access exceeding their role or who no longer appears in HR records
Document review in a coversheet: reviewer name, review date, systems covered, exceptions found, remediation actions
For application-level access, review must include customer-facing roles if those users can access sensitive service data
Tools / Systems
AWS IAM Access AnalyzerOkta admin consoleGitHub org export
Typical Control Least privilege for production infrastructure access
Implementation Steps
Audit all IAM roles and policies, use AWS IAM Access Analyzer or Azure AD Access Reviews to identify overprivileged accounts
Replace wildcard policies (Action: '*') with scoped permissions tied to specific resources and actions
Separate read-only access (needed by most engineers for debugging) from write/admin access (needed by a small team for changes)
Implement just-in-time (JIT) access for production admin operations, elevated access is granted for a session window, not permanently assigned
Tools / Systems
AWS IAM Access AnalyzerAzure AD Privileged Identity Management (PIM)HashiCorp Boundary (JIT access)CrowdStrike Identity Protection
Typical Control Periodic user access reviews against RBAC matrix
Evidence Artifacts
Access review coversheet signed by reviewer, showing date and systems reviewed
User export from each in-scope system at the time of review (CSV or screenshot)
Remediation tickets for any access removed as a result of the review
📅Quarterly for production application and infrastructure; annual for SaaS tools
Typical Control Least privilege for production infrastructure access
Evidence Artifacts
IAM policy review showing no wildcard admin policies on production roles
Screenshot of PIM or JIT access configuration showing time-limited elevation
Access Analyzer findings report showing no unintended public or cross-account access
📅Quarterly IAM review; continuous monitoring alerts for new privilege escalations
Cross-framework mappings coming in v1.1
When we add ISO 42001 and ISO 27001, you'll see which controls map to this criterion.
ISO
ISO 42001
AI Management Systems
ISO
ISO 27001
Information Security
Mapping data will appear here automatically when the frameworks are published.
CC6.4
Physical access restrictions
Logical and Physical Access Controls
3 evidence1 control
CC6.5
Disposal and destruction of information assets
Logical and Physical Access Controls
3 evidence1 control
CC6.6
Controls against threats from outside system boundaries
Logical and Physical Access Controls
8 evidence2 controls
CC6.7
Restricts transmission and movement of information
Logical and Physical Access Controls
7 evidence2 controls
CC6.8
Controls to prevent or detect unauthorized software
Logical and Physical Access Controls
6 evidence2 controls
CC7.1
Detection and monitoring for vulnerabilities
System Operations
8 evidence2 controls
CC7.2
Monitoring for anomalies and security events
System Operations
4 evidence1 control
CC7.3
Evaluation of security events as security incidents
System Operations
4 evidence1 control
CC7.4
Incident response program
System Operations
4 evidence1 control
CC7.5
Recovery from security incidents
System Operations
4 evidence1 control
CC8.1
Authorized change management process
Change Management
8 evidence2 controls
CC9.1
Risk mitigation for business disruptions
Risk Mitigation
4 evidence1 control
CC9.2
Vendor and business partner risk management
Risk Mitigation
4 evidence1 control
Help us build what matters.
Vote for the next framework, subscribe for updates, and let us know if you'd contribute.
What should we add next?
Vote for the framework you need most.
0
ISO 42001
0
ISO 27001
0
CMMC
0
CPCSC
Stay Updated
Get notified when new frameworks and features are added.
On-premises implementation and evidence
Periodic user access reviews against RBAC matrix
Implementation steps
Export AD group membership for all production-access groups; export VPN user list and bastion authorized accounts
Cross-reference against current HR roster, anyone who left or changed roles since the last review is a finding
Review privileged groups (Domain Admins, local Administrators on production servers), these should have the fewest members
Sign and date the review coversheet; file it as audit evidence
Tools / systems
Active Directory (Get-ADGroupMember export)
PowerShell scripts for group membership reports
Excel / Google Sheets (review coversheet template)
Evidence artifacts
AD group membership export for all production-access groups, dated at time of review
Signed review coversheet with findings and remediation actions
Tickets showing removal of excess access found during review
Evidence frequency: Quarterly for infrastructure and application; semi-annual minimum; annual for SaaS
Least privilege for production infrastructure access
Implementation steps
Remove all shared/generic admin accounts, every admin must have a named account with individual accountability
Restrict Domain Admin membership to the absolute minimum; use tiered admin accounts (tier 0 / tier 1 model)
Administrative access to production servers is restricted to the management network; no direct RDP/SSH from user VLAN
Document the intended privilege level for each role in the RBAC matrix and review deviations quarterly
