Free compliance framework explorer — browse controls, evidence, and implementation guidance.Subscribe for updates →
BETA
SOC 247
ITSP.10.17198
ISO 42001soon
ISO 27001soon
Browse
Ctrl+K
33 controls
CC1.1
Commitment to integrity and ethical values
Control Environment
6 evidence2 controls
CC1.2
Board independence and oversight of internal control
Control Environment
3 evidence1 control
CC1.3
Organizational structure, reporting lines, and authority
Control Environment
3 evidence1 control
CC1.4
Commitment to attract, develop, and retain competent individuals
Control Environment
6 evidence2 controls
CC1.5
Accountability for internal control responsibilities
Control Environment
3 evidence1 control
CC2.1
Obtains or generates and uses relevant quality information
Communication and Information
3 evidence1 control
CC2.2
Internal communication of information to support internal control
Communication and Information
6 evidence2 controls
CC2.3
External communication regarding matters affecting internal control
Communication and Information
4 evidence1 control
CC3.1
Specifies objectives with sufficient clarity
Risk Assessment
3 evidence1 control
CC3.2
Identifies and analyzes risks to achievement of objectives
Risk Assessment
3 evidence1 control
CC3.3
Considers potential for fraud in assessing risks
Risk Assessment
3 evidence1 control
CC3.4
Identifies and assesses significant changes
Risk Assessment
3 evidence1 control
CC4.1
Selects, develops, and performs ongoing and separate evaluations
Monitoring Activities
6 evidence2 controls
CC4.2
Evaluates and communicates internal control deficiencies
Monitoring Activities
3 evidence1 control
CC5.1
Selects and develops control activities that mitigate risks
Control Activities
3 evidence1 control
CC5.2
Selects and develops general controls over technology
Control Activities
6 evidence2 controls
CC5.3
Deploys control activities through policies and procedures
Control Activities
3 evidence1 control
CC6.1
Logical access security infrastructure
Logical and Physical Access Controls
11 evidence3 controls
CC6.2
Registration and authorization prior to issuing credentials
Logical and Physical Access Controls
6 evidence2 controls
CC6.3
Role-based access management
Logical and Physical Access Controls
6 evidence2 controls
CC6.4
Physical access restrictions
Logical and Physical Access Controls
3 evidence1 control
CC6.5
Disposal and destruction of information assets
Logical and Physical Access Controls
3 evidence1 control
CC6.6
Controls against threats from outside system boundaries
Logical and Physical Access Controls
8 evidence2 controls
CC6.7
Restricts transmission and movement of information
Logical and Physical Access Controls
7 evidence2 controls
CC6.8
Controls to prevent or detect unauthorized software
Logical and Physical Access Controls
6 evidence2 controls
CC7.1Detection and monitoring for vulnerabilitiesSOC 2System Operations
Official Requirement
To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
You have tooling that watches for two things: someone changing a configuration in a way that opens a hole (a rule gets loosened, a port gets opened, a default gets changed), and newly disclosed CVEs that affect software you're already running. This isn't a quarterly scan, auditors expect continuous or near-continuous detection with a documented remediation SLA.
These are typical controls and implementation steps. Your systems and environment may differ.
Typical Control Continuous vulnerability scanning with SLA-driven remediation
Implementation Steps
Deploy an agent-based vulnerability scanner across all production instances, AWS Inspector, your EDR solution Spotlight, or Qualys; configure scan frequency to daily or continuous
Run automated DAST (dynamic application security testing) scans against web applications and APIs on a recurring schedule (weekly or per-release in CI/CD); DAST tests the running application for injection flaws, authentication issues, and misconfigurations that static analysis cannot catch
Set up CVE alerting for critical and high findings with a defined SLA: critical within 7 days, high within 30 days, medium within 90 days
Route scan findings into Jira automatically so every finding has a ticket owner and due date, this is the paper trail auditors want
Run a weekly report of open findings vs. SLA; any overdue critical or high finding requires a documented risk acceptance signed by management
Tools / Systems
AWS InspectorCrowdStrike SpotlightQualysTenable.ioOWASP ZAP (DAST, open source)Burp Suite (DAST)Jira (finding tickets)Datadog (configuration drift alerts)
Typical Control Configuration drift detection and baseline enforcement
Implementation Steps
Enable AWS Config or Azure Policy to detect configuration drift from approved baselines in real time, flag any security group change, IAM policy modification, or S3 bucket policy update
Set up your monitoring platform or CloudWatch alerts for configuration changes to security-relevant resources; route to the security Slack channel or your alerting/on-call platform
Use Terraform or IaC as the single source of truth for infrastructure configuration; any out-of-band change should trigger a drift alert
Document the approved configuration baselines in your Configuration and Asset Management Policy so auditors can see what 'compliant' looks like
Tools / Systems
AWS ConfigAzure PolicyTerraform (drift detection via plan)DatadogAWS CloudWatchPagerDuty
Typical Control Continuous vulnerability scanning with SLA-driven remediation
Evidence Artifacts
AWS Inspector or scanner dashboard screenshot showing scan coverage across production instances, dated
Jira export of vulnerability tickets opened and closed during the audit period with SLA compliance rate
Sample critical finding: ticket showing discovery date, severity, assignee, and closure date within SLA
Any risk acceptances for overdue findings, signed by management with compensating control noted
When we add ISO 42001 and ISO 27001, you'll see which controls map to this criterion.
ISO
ISO 42001
AI Management Systems
ISO
ISO 27001
Information Security
Mapping data will appear here automatically when the frameworks are published.
CC7.2
Monitoring for anomalies and security events
System Operations
4 evidence1 control
CC7.3
Evaluation of security events as security incidents
System Operations
4 evidence1 control
CC7.4
Incident response program
System Operations
4 evidence1 control
CC7.5
Recovery from security incidents
System Operations
4 evidence1 control
CC8.1
Authorized change management process
Change Management
8 evidence2 controls
CC9.1
Risk mitigation for business disruptions
Risk Mitigation
4 evidence1 control
CC9.2
Vendor and business partner risk management
Risk Mitigation
4 evidence1 control
Help us build what matters.
Vote for the next framework, subscribe for updates, and let us know if you'd contribute.
What should we add next?
Vote for the framework you need most.
0
ISO 42001
0
ISO 27001
0
CMMC
0
CPCSC
Stay Updated
Get notified when new frameworks and features are added.
On-premises implementation and evidence
Continuous vulnerability scanning with SLA-driven remediation
Implementation steps
Install vulnerability/configuration management agents on all production servers; enable the vulnerability detection module to scan installed packages against the NVD CVE feed
Run periodic DAST scans (OWASP ZAP, Nikto) against internally hosted web applications to identify runtime vulnerabilities such as injection flaws, broken authentication, and server misconfigurations
For network appliances that cannot run agents (firewall appliance, switches), subscribe to vendor security advisories and log advisory reviews as work orders
Set up alerts for critical findings so the responsible team is notified and can action within 24 hours
Track all findings in a vulnerability register (a spreadsheet or your GRC platform) with discovery date, severity, assigned owner, and closure date
Tools / systems
Tenable (vulnerability management)
ConnectSecure (vulnerability and configuration management)
OpenSCAP (security configuration management)
OWASP ZAP (DAST, open source)
Nikto (web server DAST scanner)
Nmap with Vulners script (network vulnerability scanning)
Security Onion (network-level detection)
NVD / vendor advisory feeds
Evidence artifacts
Wazuh vulnerability detection report for a representative production server showing CVE matches and severity ratings
Vulnerability register showing findings opened and closed during the audit period
Sample vendor advisory review note (for non-agent appliances) confirming advisory was assessed and action taken or accepted
Screenshot of Wazuh alert configuration confirming critical CVE alerting is enabled
Evidence frequency: Weekly scans; vulnerability register updated at each finding; quarterly review of open items
Configuration drift detection and baseline enforcement
Implementation steps
Enable your SIEM/monitoring platform file integrity monitoring (FIM) on critical configuration files: /etc, sshd_config, firewall rules, IIS config, any change triggers an alert
Use Ansible playbooks to define desired configuration state; run Ansible in check mode weekly to detect drift from baseline
Log all firewall rule changes in a change log with before/after state; the ISM must review and approve any firewall modification before implementation
Set a quarterly CIS benchmark run via your SIEM/monitoring platform to score production servers against the approved baseline and document the score delta
Tools / systems
Wazuh (log collection/HIDS)
Ansible (configuration management)
Security Onion
Git (config versioning)
Firewall appliance audit log
Evidence artifacts
Wazuh FIM alert log showing a monitored configuration file change, with timestamp and changed content
Ansible check-mode output showing production systems in compliance with the baseline playbook
Quarterly CIS benchmark score report for at least one production server
Change log showing firewall rule modifications with approvals
