Free compliance framework explorer — browse controls, evidence, and implementation guidance.Subscribe for updates →
BETA
SOC 247
ITSP.10.17198
ISO 42001soon
ISO 27001soon
Browse
Ctrl+K
33 controls
CC1.1
Commitment to integrity and ethical values
Control Environment
6 evidence2 controls
CC1.2
Board independence and oversight of internal control
Control Environment
3 evidence1 control
CC1.3
Organizational structure, reporting lines, and authority
Control Environment
3 evidence1 control
CC1.4
Commitment to attract, develop, and retain competent individuals
Control Environment
6 evidence2 controls
CC1.5
Accountability for internal control responsibilities
Control Environment
3 evidence1 control
CC2.1
Obtains or generates and uses relevant quality information
Communication and Information
3 evidence1 control
CC2.2
Internal communication of information to support internal control
Communication and Information
6 evidence2 controls
CC2.3
External communication regarding matters affecting internal control
Communication and Information
4 evidence1 control
CC3.1
Specifies objectives with sufficient clarity
Risk Assessment
3 evidence1 control
CC3.2
Identifies and analyzes risks to achievement of objectives
Risk Assessment
3 evidence1 control
CC3.3
Considers potential for fraud in assessing risks
Risk Assessment
3 evidence1 control
CC3.4
Identifies and assesses significant changes
Risk Assessment
3 evidence1 control
CC4.1
Selects, develops, and performs ongoing and separate evaluations
Monitoring Activities
6 evidence2 controls
CC4.2
Evaluates and communicates internal control deficiencies
Monitoring Activities
3 evidence1 control
CC5.1
Selects and develops control activities that mitigate risks
Control Activities
3 evidence1 control
CC5.2
Selects and develops general controls over technology
Control Activities
6 evidence2 controls
CC5.3
Deploys control activities through policies and procedures
Control Activities
3 evidence1 control
CC6.1
Logical access security infrastructure
Logical and Physical Access Controls
11 evidence3 controls
CC6.2
Registration and authorization prior to issuing credentials
Logical and Physical Access Controls
6 evidence2 controls
CC6.3
Role-based access management
Logical and Physical Access Controls
6 evidence2 controls
CC6.4
Physical access restrictions
Logical and Physical Access Controls
3 evidence1 control
CC6.5
Disposal and destruction of information assets
Logical and Physical Access Controls
3 evidence1 control
CC6.6Controls against threats from outside system boundariesSOC 2Logical and Physical Access Controls
Official Requirement
The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
This criterion covers your external attack surface: what stops a threat actor from getting in from the internet? Firewall rules, IDS/IPS, WAF, email filtering, endpoint detection, DNS filtering, any control that reduces exposure at the boundary. The key is that these controls must be monitored and alert on events; passive controls that no one watches don't satisfy the criterion.
These are typical controls and implementation steps. Your systems and environment may differ.
Typical Control Perimeter firewall with default-deny policy and reviewed ruleset
Implementation Steps
All security groups and NACLs must default to deny; every open port must have a documented business justification
No security group should allow 0.0.0.0/0 inbound on SSH (22), RDP (3389), or database ports (3306, 5432, 1433), these are immediate audit findings
Implement a WAF (AWS WAF, Cloudflare) in front of any public-facing application, configure managed rules plus custom rules for your application's attack surface
Review security group rules quarterly; use AWS Config or Azure Policy to flag any rule that opens admin ports to the internet
Typical Control Endpoint detection and response (EDR) with active monitoring
Implementation Steps
Deploy EDR on all cloud instances that run workloads, agent-based solutions like your EDR solution or vulnerability/configuration management agents cover EC2 instances, not just endpoints
Configure real-time alerting for detections, an EDR that does not alert is not a compensating control
Integrate EDR alerts into your SIEM or alerting channel (Slack, your alerting/on-call platform) so detections are reviewed within the defined SLA
Maintain evidence of 100% agent coverage, a single unprotected production instance is an audit finding
Typical Control Perimeter firewall with default-deny policy and reviewed ruleset
Evidence Artifacts
Security group export showing inbound rules for all production instances, confirm no open admin ports
WAF configuration screenshot showing managed rules enabled and monitoring mode or blocking mode active
AWS Config compliance report showing no non-compliant security group rules (or remediation tickets for findings)
Quarterly security group review ticket with sign-off
📅Quarterly rule review with documented sign-off; continuous AWS Config monitoring
Typical Control Endpoint detection and response (EDR) with active monitoring
Evidence Artifacts
EDR console screenshot showing all in-scope instances have an active agent, no unprotected instances
Alert configuration screenshot showing detection routing to SIEM or alerting channel
Sample detection record with investigation notes (even if benign, shows the process works)
📅Quarterly coverage report; detection records collected continuously during audit period
Cross-framework mappings coming in v1.1
When we add ISO 42001 and ISO 27001, you'll see which controls map to this criterion.
ISO
ISO 42001
AI Management Systems
ISO
ISO 27001
Information Security
Mapping data will appear here automatically when the frameworks are published.
CC6.7
Restricts transmission and movement of information
Logical and Physical Access Controls
7 evidence2 controls
CC6.8
Controls to prevent or detect unauthorized software
Logical and Physical Access Controls
6 evidence2 controls
CC7.1
Detection and monitoring for vulnerabilities
System Operations
8 evidence2 controls
CC7.2
Monitoring for anomalies and security events
System Operations
4 evidence1 control
CC7.3
Evaluation of security events as security incidents
System Operations
4 evidence1 control
CC7.4
Incident response program
System Operations
4 evidence1 control
CC7.5
Recovery from security incidents
System Operations
4 evidence1 control
CC8.1
Authorized change management process
Change Management
8 evidence2 controls
CC9.1
Risk mitigation for business disruptions
Risk Mitigation
4 evidence1 control
CC9.2
Vendor and business partner risk management
Risk Mitigation
4 evidence1 control
Help us build what matters.
Vote for the next framework, subscribe for updates, and let us know if you'd contribute.
What should we add next?
Vote for the framework you need most.
0
ISO 42001
0
ISO 27001
0
CMMC
0
CPCSC
Stay Updated
Get notified when new frameworks and features are added.
On-premises implementation and evidence
Perimeter firewall with default-deny policy and reviewed ruleset
Implementation steps
Deploy a stateful firewall appliance at the network perimeter with a default-deny outbound and inbound policy
All firewall rule changes go through the change management process: ticket, approval, implementation, documentation
Conduct a full firewall rule review quarterly, each rule must have a documented owner and business justification; delete any rules that cannot be justified
Integrate the firewall with your SIEM (your IDS/network monitoring platform, your SIEM/monitoring platform) so firewall deny events and anomalies are logged and reviewed
Tools / systems
Firewall appliance (enterprise-grade)
Security Onion (IDS/NSM)
Wazuh (SIEM/log aggregation)
Firewall change tickets
Evidence artifacts
Firewall rule export (full ruleset), auditors will sample specific rules and ask for justification
Quarterly firewall rule review ticket with sign-off and notation of any rules removed
SIEM dashboard screenshot showing firewall event collection is active and logs are being received
Change tickets for any firewall rule modifications during the audit period
Endpoint detection and response (EDR) with active monitoring
Implementation steps
Deploy anti-malware and EDR on all production servers and user endpoints, coverage must be 100% of in-scope assets
Configure automated definition updates and verify update status is centrally monitored
Set scan schedule for on-prem servers (real-time plus scheduled full scan at off-peak hours)
Route EDR/AV alerts to your SIEM (your SIEM/monitoring platform / your IDS/network monitoring platform) and confirm detections are reviewed within the detection response SLA
Tools / systems
CrowdStrike Falcon (if budget allows)
Wazuh (open source EDR/SIEM)
ESET Endpoint Security
Security Onion (network IDS)
Evidence artifacts
AV/EDR console showing all in-scope endpoints with agent status: active, definitions current, no unresolved critical threats
Sample scan output or detection log from the audit period
Scan schedule configuration showing scheduled scans are configured on production servers
SIEM screenshot confirming AV/EDR logs are being received and stored
Evidence frequency: Quarterly console screenshot; detection logs collected at audit window close
