Change management for infrastructure, data and software

frameworkSOC 2 (Trust Services Criteria) sectionCC8 Change management csf 2.0PR.PS-06 topicsSecure Development frameworks0 8 5

Official text · not licensableSummary (ControlMapping's wording): Change management for infrastructure, data and software. The criterion text is AICPA's copyright.

gap from SOC 2 → gap to SOC 2 →

Wrong or missing mapping? Report it

Equivalents of CC8.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.PS-06	Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle	Editorial	Same topic: Secure Development (editorial pick)
ISO 27001	A.8.25 A.8.26 A.8.28 A.8.29 A.8.9 A.8.32	Secure development life cycle; Application security requirements…	Editorial	Same topic: Secure Development (editorial pick) ControlMapping editorial: Authorising, testing and approving changes: change management (A.8.32) and configuration management (A.8.9). 1 loosely related (not mappings) A.8.31 Separation of development, test and production environments Loosely related Only shares CSF PR.PS-06: related, not a mapping
CIS v8.1	CIS 16.1 CIS 16.2 CIS 16.3 CIS 16.5 CIS 16.8 CIS 16.9 CIS 16.11 CIS 16.12 CIS 16.13 CIS 16.14	Establish and Maintain a Secure Application Development Process; Establish and Maintain a Process to Accept and Address Software Vulnerabilities…	Editorial	Same topic: Secure Development (editorial pick) 3 loosely related (not mappings) CIS 9.3 Maintain and Enforce Network-Based URL Filters Loosely related Only shares CSF PR.PS-06: related, not a mapping CIS 13.10 Perform Application Layer Filtering Loosely related Only shares CSF PR.PS-06: related, not a mapping CIS 16.10 Apply Secure Design Principles in Application Architectures Loosely related Only shares CSF PR.PS-06: related, not a mapping
PCI DSS	6.2.1 6.2.2 6.2.3	Bespoke and custom software developed securely; Developers trained in secure software development…	Editorial	Same topic: Secure Development (editorial pick) 5 loosely related (not mappings) 6.2.4 Coding techniques prevent common software attacks Loosely related Only shares CSF PR.PS-06: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF PR.PS-06: related, not a mapping 6.4.1 Public web applications protected against attacks Loosely related Only shares CSF PR.PS-06: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF PR.PS-06: related, not a mapping 11.4.4 Penetration test findings corrected and retested Loosely related Only shares CSF PR.PS-06: related, not a mapping
CMMC	SC.L2-3.13.2	Security Engineering	Editorial	Same topic: Secure Development (editorial pick)
800-53	SA-3 SA-8 SA-11 SA-15	System Development Life Cycle; Security and Privacy Engineering Principles…	Editorial	Same topic: Secure Development (editorial pick) 4 loosely related (not mappings) SA-10 Developer Configuration Management Loosely related Only shares CSF PR.PS-06: related, not a mapping SA-17 Developer Security and Privacy Architecture and Design Loosely related Only shares CSF PR.PS-06: related, not a mapping SA-24 Design For Cyber Resiliency Loosely related Only shares CSF PR.PS-06: related, not a mapping SI-10 Information Input Validation Loosely related Only shares CSF PR.PS-06: related, not a mapping
HIPAA	—	No requirement	No mapping in our data	No mapping in our data.
GDPR	Art.25(1)	Data protection by design and by default	Editorial	Same topic: Secure Development (editorial pick)
NIS2	6.2 6.4	Secure development life cycle; Change management, repairs and maintenance	Editorial	Same topic: Secure Development (editorial pick) ControlMapping editorial: Change management: SOC 2 requires changes to be authorised, tested and approved; NIS2 point 6.4 requires change management, repairs and maintenance procedures.
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	—	No requirement	No mapping in our data	No mapping in our data (DORA links are editorial, and its technical standards are not mapped).
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.