CFTC System Safeguards (17 CFR 37, 38, 39, 49)
CFTC System Safeguards: Cybersecurity Testing

CFTC System Safeguards (17 CFR 37, 38, 39, 49) CFTC-SS-35: Scope of Testing and Assessment

Set the scope of all system safeguards testing and assessment broadly enough to include the automated systems and controls that the program and the current cybersecurity threat analysis indicate are necessary to identify risks and vulnerabilities that could enable an intruder, unauthorised user or insider to interfere with operations or regulatory responsibilities, impair reliability, security or capacity, alter or exfiltrate regulated activity data, or take other unauthorised action.

What else in your programme already covers this

This control maps to 25 controls across 16 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-161 Rev 1 · 3 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

FedRAMP High · 2 controls

  • RA-5(3) Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage. Define the breadth and depth of vulnerability scanning coverage
  • SI-4(18) System Monitoring | Analyze Traffic and Covert Exfiltration. Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: [Assignment: organization-defined interior points

FedRAMP Moderate · 2 controls

  • RA-5(3) Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage. Define the breadth and depth of vulnerability scanning coverage
  • SI-4(18) System Monitoring | Analyze Traffic and Covert Exfiltration. Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: [Assignment: organization-defined interior points

ISO 27001:2022 · 2 controls

  • 5.7 Threat intelligence
  • 8.34 Protection of information systems during audit testing

ISO 27002:2022 · 2 controls

  • 5.7 Threat intelligence
  • 8.34 Protection of information systems during audit testing

NIST Cybersecurity Framework 2.0 · 2 controls

  • NIST-CSF-ID.AM-02 Inventories of software, services, and systems managed by the organization are maintained
  • NIST-CSF-ID.AM-05 Assets are prioritized based on classification, criticality, resources, and impact on the mission

PCI DSS 4.0 · 2 controls

  • 11.4.1 Penetration testing methodology defined
  • 12.5.2 PCI DSS scope documented and confirmed annually

C5 (Germany) · 1 control

  • C5-OPS-19 Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests

CIS Controls v8 · 1 control

  • CIS-18.1 Establish and Maintain a Penetration Testing Program

DORA · 1 control

  • DORA-Art.24 General requirements for the performance of digital operational resilience testing

HIPAA Security Rule · 1 control

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-53 Rev 5 · 1 control

  • NIST800-PM-31 Continuous Monitoring Strategy. Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: Establishing the following organization-wide metrics to be monitored: [organization-defined]; Establishing [organization-defined] and [organization-defined] for control effectiveness; Ongoing monitoring

NIST SP 800-66 Rev 2 · 1 control

SOC 2 · 1 control

  • SOC2-CC4.1 COSO principle 16: Selects and develops ongoing and separate evaluations

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in CFTC System Safeguards: Cybersecurity Testing

You are reading one control. How much of CFTC System Safeguards (17 CFR 37, 38, 39, 49) have you already done?

CFTC System Safeguards (17 CFR 37, 38, 39, 49) CFTC-SS-35 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CFTC System Safeguards (17 CFR 37, 38, 39, 49) your existing evidence covers. Hold NIST Cybersecurity Framework 2.0 and 28 of 39 CFTC System Safeguards (17 CFR 37, 38, 39, 49) controls already carry evidence.

If you hold NIST Cybersecurity Framework 2.071.8% covered · 11 gapsIf you hold FedRAMP Moderate69.2% covered · 12 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.161.5% covered · 15 gapsIf you hold C5 (Germany)59% covered · 16 gapsIf you hold DORA51.3% covered · 19 gapsIf you hold NIST SP 800-161 Rev 148.7% covered · 20 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 5 were rejected on the NIST Cybersecurity Framework 2.0 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 25 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll CFTC System Safeguards (17 CFR 37, 38, 39, 49) controls