Protection against threats from outside system boundaries

frameworkSOC 2 (Trust Services Criteria) sectionCC6 Logical and physical access csf 2.0DE.CM-01 ID.AM-03 PR.AA-03 PR.AA-04 PR.AA-05 PR.IR-01 PR.PS-06 topicsFirewall / Net Seg, Web Security, Zero Trust, WAF frameworks0 9 0

Official text · not licensableSummary (ControlMapping's wording): Protection against threats from outside system boundaries. The criterion text is AICPA's copyright.

gap from SOC 2 → gap to SOC 2 →

Wrong or missing mapping? Report it

Equivalents of CC6.6 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-01 ID.AM-03 PR.AA-03 PR.AA-04 PR.AA-05 PR.IR-01 PR.PS-06	Networks and network services are monitored to find potentially adverse events; Representations of the organization's authorized network communication and internal and external network data flows are maintained…	Editorial	Same topic: WAF, Firewall / Net Seg, Zero Trust, Web Security (editorial pick)
ISO 27001	A.5.15 A.8.5 A.8.20 A.8.21 A.8.22 A.8.26	Access control; Secure authentication…	Editorial	Same topic: Zero Trust, Firewall / Net Seg, WAF, Web Security (editorial pick) 18 loosely related (not mappings) A.5.16 Identity management Loosely related Only shares CSF PR.AA-03, PR.AA-04, PR.AA-05: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF ID.AM-03, PR.AA-05: related, not a mapping A.5.17 Authentication information Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping A.5.18 Access rights Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF PR.AA-05: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.AA-05: related, not a mapping A.6.7 Remote working Loosely related Only shares CSF PR.AA-05: related, not a mapping A.8.2 Privileged access rights Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 10 more in the downloads
CIS v8.1	CIS 4.4 CIS 4.5 CIS 6.8 CIS 9.3 CIS 12.2 CIS 12.3 CIS 12.4 CIS 12.6 CIS 12.7 CIS 13.4 CIS 13.5 CIS 13.9 CIS 13.10 CIS 16.10	Implement and Manage a Firewall on Servers; Implement and Manage a Firewall on End-User Devices…	Editorial	Same topic: Firewall / Net Seg, Zero Trust, Web Security, WAF (editorial pick) 38 loosely related (not mappings) CIS 16.12 Implement Code-Level Security Checks Loosely related Only shares CSF PR.AA-03, PR.IR-01, PR.PS-06: related, not a mapping CIS 4.9 Configure Trusted DNS Servers on Enterprise Assets Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping CIS 8.6 Collect DNS Query Audit Logs Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping CIS 9.2 Use DNS Filtering Services Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping CIS 3.3 Configure Data Access Control Lists Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 3.8 Document Data Flows Loosely related Only shares CSF ID.AM-03: related, not a mapping CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Loosely related Only shares CSF PR.IR-01: related, not a mapping CIS 4.10 Enforce Automatic Device Lockout on Portable End-User Devices Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 30 more in the downloads
PCI DSS	1.2.1 1.2.3 1.3.1 1.4.1 6.4.1 6.4.2 6.4.3 7.2.1 8.3.1	Configuration standards for network security controls; Accurate network diagram maintained…	Editorial	Same topic: Firewall / Net Seg, Web Security, WAF, Zero Trust (editorial pick) 45 loosely related (not mappings) 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF DE.CM-01, ID.AM-03, PR.IR-01: related, not a mapping 6.2.4 Coding techniques prevent common software attacks Loosely related Only shares CSF PR.AA-03, PR.IR-01, PR.PS-06: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 11.2.1 Wireless access points detected and unauthorised ones handled Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 2.2.2 Vendor default accounts managed or removed Loosely related Only shares CSF PR.AA-03: related, not a mapping 2.3.1 Wireless vendor defaults changed Loosely related Only shares CSF PR.AA-03: related, not a mapping 3.5.1.3 Disk encryption access managed separately from OS access Loosely related Only shares CSF PR.AA-03: related, not a mapping 3.6.1 Procedures protect keys that secure stored account data Loosely related Only shares CSF PR.AA-04: related, not a mapping …and 37 more in the downloads
CMMC	AC.L2-3.1.1 SC.L2-3.13.1 SC.L2-3.13.5 SC.L2-3.13.6	Authorized Access Control; Boundary Protection…	Editorial	Same topic: Zero Trust, Firewall / Net Seg, Web Security (editorial pick) 38 loosely related (not mappings) SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF DE.CM-01, PR.IR-01, PR.PS-06: related, not a mapping SC.L2-3.13.3 Role Separation Loosely related Only shares CSF DE.CM-01, PR.AA-05, PR.IR-01: related, not a mapping AC.L2-3.1.2 Transaction & Function Control Loosely related Only shares CSF PR.AA-05, PR.IR-01: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-01, PR.AA-05: related, not a mapping AC.L2-3.1.3 Control CUI Flow Loosely related Only shares CSF PR.IR-01: related, not a mapping AC.L2-3.1.4 Separation of Duties Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.5 Least Privilege Loosely related Only shares CSF PR.AA-05: related, not a mapping AC.L2-3.1.6 Non-Privileged Account Use Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 30 more in the downloads
800-53	AC-3 AC-4 AC-6 IA-2 SC-7 SI-10	Access Enforcement; Information Flow Enforcement…	Editorial	Same topic: Zero Trust, Firewall / Net Seg, Web Security, WAF (editorial pick) 44 loosely related (not mappings) AC-2 Account Management Loosely related Only shares CSF DE.CM-01, PR.AA-05: related, not a mapping IA-13 Identity Providers and Authorization Servers Loosely related Only shares CSF PR.AA-04, PR.AA-05: related, not a mapping SC-5 Denial-of-service Protection Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping SC-20 Secure Name/Address Resolution Service (Authoritative Source) Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping SC-22 Architecture and Provisioning for Name/Address Resolution Service Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping AC-2(7) Privileged User Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping AC-5 Separation of Duties Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 36 more in the downloads
HIPAA	§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(B)§164.310(b)§164.312(a)(2)(i)	Authorization and/or Supervision; Access Authorization…	Loosely related	No mapping. Only shares CSF DE.CM-01, ID.AM-03, PR.AA-05, PR.IR-01…: related, not a mapping +24 more loosely related (not mappings) §164.308(a)(3) Workforce Security Loosely related Only shares CSF DE.CM-01, PR.AA-05, PR.IR-01: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF DE.CM-01, PR.AA-05, PR.IR-01: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF DE.CM-01, PR.AA-05: related, not a mapping §164.308(a)(4) Information Access Management Loosely related Only shares CSF DE.CM-01, PR.AA-05: related, not a mapping …and 20 more in the downloads
GDPR	Art.25(1)Art.25(2)Art.28(1)Art.32(1)(b)	Data protection by design and by default; Data protection by design and by default…	Loosely related	No mapping. Only shares CSF PR.PS-06, PR.AA-05, PR.IR-01: related, not a mapping
NIS2	6.7 6.8 11.1 11.6	Network security; Network segmentation…	Editorial	Same topic: Firewall / Net Seg, Zero Trust (editorial pick) 8 loosely related (not mappings) 4.3 Crisis management Loosely related Only shares CSF DE.CM-01, ID.AM-03: related, not a mapping 6.2 Secure development life cycle Loosely related Only shares CSF PR.PS-06: related, not a mapping 6.9 Protection against malicious and unauthorised software Loosely related Only shares CSF DE.CM-01: related, not a mapping 11.2 Management of access rights Loosely related Only shares CSF PR.AA-05: related, not a mapping 11.4 Administration systems Loosely related Only shares CSF PR.AA-05: related, not a mapping 11.5 Identification Loosely related Only shares CSF PR.AA-05: related, not a mapping 11.7 Multi-factor authentication Loosely related Only shares CSF PR.AA-03: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-03: related, not a mapping
Essential Eight	ISM-0109 ISM-0445 ISM-0974 ISM-1173	Event logs from workstations are analysed in a timely manner to detect cyber security…; Privileged human users are assigned a dedicated privileged user account to be used……	Loosely related	No mapping. Only shares CSF DE.CM-01, PR.AA-05, PR.AA-03: related, not a mapping +35 more loosely related (not mappings) ISM-1175 Privileged user accounts (excluding those explicitly authorised to access online… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1380 Privileged human users use separate privileged and unprivileged operating environments Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1387 Administrative activities are conducted through jump servers Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1401 Multi-factor authentication uses either: something people have and something people… Loosely related Only shares CSF PR.AA-03: related, not a mapping …and 31 more in the downloads
DORA	Art.9(4)(b)	Protection and prevention	Editorial	Same topic: Firewall / Net Seg (editorial pick) 8 loosely related (not mappings) Art.9(1) Protection and prevention Loosely related Only shares CSF DE.CM-01: related, not a mapping Art.9(4)(c) Protection and prevention Loosely related Only shares CSF PR.AA-05: related, not a mapping Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.AA-03: related, not a mapping Art.10(1) Detection Loosely related Only shares CSF DE.CM-01: related, not a mapping Art.10(2) Detection Loosely related Only shares CSF DE.CM-01: related, not a mapping Art.10(3) Detection Loosely related Only shares CSF DE.CM-01: related, not a mapping Art.28(8) General principles Loosely related Only shares CSF PR.IR-01: related, not a mapping Art.30(2) Key contractual provisions Loosely related Only shares CSF PR.IR-01: related, not a mapping
CPS 234	Para 23	Detect and respond to incidents in a timely manner	Loosely related	No mapping. Only shares CSF DE.CM-01: related, not a mapping
Cyber Essentials	CE 1	Firewalls	Editorial	Same topic: Firewall / Net Seg (editorial pick) 2 loosely related (not mappings) CE 4 User Access Control Loosely related Only shares CSF PR.AA-03, PR.AA-05, PR.IR-01: related, not a mapping CE 2 Secure Configuration Loosely related Only shares CSF PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.