Cross-Framework Mapping

SOC 2vsCFTC System Safeguards (17 CFR 37, 38, 39, 49)

See exactly how SOC 2 controls map to CFTC System Safeguards (17 CFR 37, 38, 39, 49). Pre-computed mappings, identified gaps, and coverage analysis.

34
Controls Mapped
27
Gaps Found
56%
Coverage

A reviewed coverage crosswalk for this pair is available. See which CFTC System Safeguards (17 CFR 37, 38, 39, 49) controls you already evidence.

According to the TheArtOfService Compliance Knowledge Graph:

SOC 2 maps to CFTC System Safeguards (17 CFR 37, 38, 39, 49) with 56% coverage across 34 directly mapped controls. Analysis of 61 SOC 2 controls identifies 27 compliance gaps, primarily concentrated in P - Privacy.

Source: TheArtOfService Knowledge Graph | 61 controls analysed | 1,016 frameworks | 316K+ cross-framework mappings

Control Mappings

Showing 20 of 61 control mappings across 3 domains. Sign up to explore all 316K+ mappings across 1,016 frameworks.

A - Availability(8 mappings)

SOC2-A1.1A1.1 Managing processing capacity2 targets
→CFTC-SS-12Capacity and Performance Planning Category
→CFTC-SS-23Resources Sufficient to Fulfil Obligations
SOC2-A1.2A1.2 Environmental protection, backup and recovery infrastructure3 targets
→CFTC-SS-22Business Continuity and Disaster Recovery Planning Category
→CFTC-SS-6Physical Security and Environmental Controls Category
→CFTC-SS-8Business Continuity and Disaster Recovery Plan and Resources
SOC2-A1.3A1.3 Testing recovery plan procedures3 targets
→CFTC-SS-11Testing and Review of Business Continuity and Disaster Recovery Capabilities
→CFTC-SS-22Business Continuity and Disaster Recovery Planning Category
→CFTC-SS-9Next Business Day Recovery Time Objective

C - Confidentiality(1 mappings)

SOC2-C1.1C1.1 Identifying and maintaining confidential information
→CFTC-SS-37Protection of Swap Data Repository Data

CC - Common Criteria (Security)(11 mappings)

SOC2-CC1.2CC1.2 Board independence and oversight of internal control (COSO principle 2)
→CFTC-SS-36Internal Reporting and Review by Senior Management and the Board
SOC2-CC1.3CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3)
→CFTC-SS-2Enterprise Risk Management and Governance Category
SOC2-CC1.4CC1.4 Attracting, developing and retaining competent people (COSO principle 4)
→CFTC-SS-3Information Security Category
SOC2-CC2.1CC2.1 Relevant, quality information to support internal control (COSO principle 13)
→CFTC-SS-20Production of System Safeguards Books and Records
SOC2-CC2.2CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)
→CFTC-SS-36Internal Reporting and Review by Senior Management and the Board
SOC2-CC2.3CC2.3 Communication with external parties about internal control (COSO principle 15)2 targets
→CFTC-SS-19Prompt Notification to the Commission
→CFTC-SS-32Timely Advance Notice of Material Planned Changes
SOC2-CC3.1CC3.1 Objectives specified clearly enough to assess risk (COSO principle 6)
→CFTC-SS-1Program of Risk Analysis and Oversight
SOC2-CC3.2CC3.2 Identifying and analysing risks to objectives (COSO principle 7)3 targets
→CFTC-SS-1Program of Risk Analysis and Oversight
→CFTC-SS-17Enterprise Technology Risk Assessment
→CFTC-SS-2Enterprise Risk Management and Governance Category

+41 more mappings

Plus AI-powered gap analysis, compliance advisory, PDF exports, and cross-mapping for all 1,016 frameworks.

Create Free Account →

Free forever, no credit card required

Coverage crosswalk

The SOC 2 to CFTC System Safeguards (17 CFR 37, 38, 39, 49) crosswalk

The table above lists candidate mappings. A crosswalk answers the narrower question you are probably here for: which CFTC System Safeguards (17 CFR 37, 38, 39, 49) controls your existing SOC 2 work already satisfies, which are real gaps, and the reasoning behind every claim so you can check it. One pair, $299, one time.

Coverage does not run both ways. SOC 2 into CFTC System Safeguards (17 CFR 37, 38, 39, 49) lands at 48.7%, while CFTC System Safeguards (17 CFR 37, 38, 39, 49) into SOC 2 lands at 29.5%, on the same two control sets. That is not a rounding difference. It is the whole reason these are two separate reports: one asks what your SOC 2 evidence buys you for CFTC System Safeguards (17 CFR 37, 38, 39, 49), the other asks the reverse.

SOC 2 into CFTC System Safeguards (17 CFR 37, 38, 39, 49)
48.7%

19 of 39 CFTC System Safeguards (17 CFR 37, 38, 39, 49) controls are evidenced by work you have already done for SOC 2. 20 are genuine gaps.

CFTC System Safeguards (17 CFR 37, 38, 39, 49) into SOC 2
29.5%

18 of 61 SOC 2 controls are evidenced by work you have already done for CFTC System Safeguards (17 CFR 37, 38, 39, 49). 43 are genuine gaps.

SOC 2 to CFTC System Safeguards (17 CFR 37, 38, 39, 49)
$299
per framework pair, one time
  • Every evidenced control, with the reasoning behind it
  • Every gap, with what it requires
  • Its level of review stated plainly, not a bare number

Why this page shows two different percentages. The 56% in the header counts how many SOC 2 controls carry at least one candidate mapping in the graph, before any review. The crosswalk percentage counts something stricter: how many CFTC System Safeguards (17 CFR 37, 38, 39, 49) controls are actually evidenced, after a pass that argued against each mapping and kept only what survived. They answer different questions and they are not meant to agree.

A crosswalk narrows the work. It does not replace an audit, and your assessor may take a different view on individual controls. Mappings between frameworks are judgements, not text printed in either standard, which is why every claim in the report shows its reasoning. Questions go to support@theartofservice.com.

Stop Paying Consultants to Read Spreadsheets

Cross-framework mappings across 1,016 frameworks, at a fraction of consulting costs.

$0/forever

Free

  • ✓ 1,016 framework browser
  • ✓ Cross-framework mappings (316K+)
  • ✓ 824 compliance assessments
  • ✓ 3 AI queries & searches per day
Get Started Free
Recommended
$149/month

Professional

  • ✓ Unlimited AI Compliance Advisory
  • ✓ Unlimited full-text search
  • ✓ Framework self-assessment
  • ✓ PDF, Excel & CSV exports
Start 7-Day Free Trial →

What are the key differences between SOC 2 and CFTC System Safeguards (17 CFR 37, 38, 39, 49)?

SOC 2 has 61 controls across its framework, while CFTC System Safeguards (17 CFR 37, 38, 39, 49) covers 39 controls. Direct mapping analysis identifies 34 overlapping controls (56% coverage). The frameworks diverge most significantly in P - Privacy, where 18 SOC 2 controls have no direct CFTC System Safeguards (17 CFR 37, 38, 39, 49) equivalent.

How many controls map between SOC 2 and CFTC System Safeguards (17 CFR 37, 38, 39, 49)?

Of 61 total SOC 2 controls, 34 map directly to CFTC System Safeguards (17 CFR 37, 38, 39, 49) controls, representing 56% coverage. The remaining 27 controls represent compliance gaps requiring additional documentation or compensating controls to satisfy both frameworks simultaneously.

What are the compliance gaps when mapping SOC 2 to CFTC System Safeguards (17 CFR 37, 38, 39, 49)?

27 SOC 2 controls have no direct equivalent in CFTC System Safeguards (17 CFR 37, 38, 39, 49). The highest concentration of gaps is in P - Privacy with 18 unmapped controls. These gaps represent areas where additional controls, policies, or documentation must be created to achieve compliance with both frameworks.

Which control domains have the most gaps between SOC 2 and CFTC System Safeguards (17 CFR 37, 38, 39, 49)?

The domain with the highest gap count is P - Privacy (18 gaps). Export the full domain-by-domain gap breakdown via the Professional tier to generate a prioritised remediation roadmap.

This platform provides educational compliance tools, not legal, regulatory, or professional compliance advice. Cross-framework mappings are AI-assisted interpretations and do not reproduce or replace official standards. Framework names and trademarks belong to their respective owners. Consult qualified professionals for your specific compliance requirements. See our Terms of Service.