SOC 2 · CC7 System operations
CC7.1
Detecting configuration changes and new vulnerabilities
frameworkSOC 2 (Trust Services Criteria)
sectionCC7 System operations
csf 2.0ID.RA-01 ID.RA-08 PR.PS-01 PR.PS-02
topicsVulnerability Mgmt, Patch Management, Secure Config
frameworks0 13 0
Official text · not licensableSummary (ControlMapping's wording): Detecting configuration changes and new vulnerabilities. The criterion text is AICPA's copyright.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-01ID.RA-08PR.PS-01PR.PS-02 | Vulnerabilities in assets are identified, validated, and recorded; Processes for receiving, analyzing, and responding to vulnerability disclosures are established… | Editorial | Same topic: Vulnerability Mgmt, Secure Config, Patch Management (editorial pick) |
| ISO 27001 | A.8.8A.8.9 | Management of technical vulnerabilities; Configuration management | Editorial | Same topic: Vulnerability Mgmt, Patch Management, Secure Config (editorial pick)5 loosely related (not mappings)A.5.9 Inventory of information and other associated assets Only shares CSF PR.PS-02: related, not a mapping |
| CIS v8.1 | CIS 2.2CIS 4.1CIS 4.2CIS 4.3CIS 4.6CIS 4.7CIS 4.8CIS 7.1CIS 7.2CIS 7.3CIS 7.4CIS 7.5CIS 7.6CIS 7.7CIS 12.1CIS 16.6CIS 16.7CIS 18.1CIS 18.2CIS 18.3CIS 18.4CIS 18.5 | Ensure Authorized Software is Currently Supported; Establish and Maintain a Secure Configuration Process… | Editorial | Same topic: Patch Management, Secure Config, Vulnerability Mgmt (editorial pick)4 loosely related (not mappings)CIS 4.10 Enforce Automatic Device Lockout on Portable End-User Devices Only shares CSF PR.PS-01: related, not a mapping CIS 4.11 Enforce Remote Wipe Capability on Portable End-User Devices Only shares CSF PR.PS-01: related, not a mapping CIS 4.12 Separate Enterprise Workspaces on Mobile End-User Devices Only shares CSF PR.PS-01: related, not a mapping |
| PCI DSS | 2.2.12.2.26.3.16.3.311.3.111.3.2 | System configuration standards developed and maintained; Vendor default accounts managed or removed… | Editorial | Same topic: Secure Config, Vulnerability Mgmt, Patch Management (editorial pick)3 loosely related (not mappings)6.3.2 Inventory of custom software and its components Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping 11.4.4 Penetration test findings corrected and retested Only shares CSF ID.RA-01: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF PR.PS-02: related, not a mapping |
| CMMC | CM.L2-3.4.1CM.L2-3.4.2CM.L2-3.4.6CM.L2-3.4.7RA.L2-3.11.2RA.L2-3.11.3SI.L2-3.14.1 | System Baselining; Security Configuration Enforcement… | Editorial | Same topic: Secure Config, Vulnerability Mgmt, Patch Management (editorial pick)15 loosely related (not mappings)…and 7 more in the downloads |
| 800-53 | CA-8CM-2CM-6CM-7RA-5SI-2 | Penetration Testing; Baseline Configuration… | Editorial | Same topic: Vulnerability Mgmt, Secure Config, Patch Management (editorial pick)18 loosely related (not mappings)…and 10 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Risk Analysis; Risk Management… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)10 loosely related (not mappings)§164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF ID.RA-01: related, not a mapping §164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Only shares CSF PR.PS-02: related, not a mapping …and 2 more in the downloads |
| GDPR | Art.32(1)(d) | Security of processing | Editorial | Same topic: Vulnerability Mgmt (editorial pick)1 loosely related (not mappings) |
| NIS2 | 6.36.56.66.10 | Configuration management; Security testing… | Editorial | Same topic: Secure Config, Vulnerability Mgmt, Patch Management (editorial pick)1 loosely related (not mappings) |
| Essential Eight | ISM-1412ISM-1501ISM-1585ISM-1621ISM-1654ISM-1691ISM-1693ISM-1695ISM-1698ISM-1699ISM-1701ISM-1702ISM-1704ISM-1807ISM-1808ISM-1859ISM-1860ISM-1876ISM-1877 | Web browsers are hardened using ASD and vendor hardening guidance, with the most…; Operating systems that are no longer supported by vendors are replaced… | Editorial | Same topic: Secure Config, Patch Management, Vulnerability Mgmt (editorial pick)41 loosely related (not mappings)ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1696 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1697 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping ISM-1700 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office… Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping …and 33 more in the downloads |
| DORA | Art.8(2)Art.9(4)(f)Art.25(1)Art.26(1)Art.27(1) | Identification; Protection and prevention… | Editorial | Same topic: Vulnerability Mgmt, Patch Management (editorial pick) |
| CPS 234 | Para 17Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness… | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| Cyber Essentials | CE 2CE 3 | Secure Configuration; Security Update Management | Editorial | Same topic: Secure Config, Vulnerability Mgmt, Patch Management (editorial pick)1 loosely related (not mappings) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.