FedRAMP High PL-8: Security and Privacy Architectures

What else in your programme already covers this

This control maps to 39 controls across 16 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 5 controls

1.2.3 Network diagrams maintained
1.2.4 Data flow diagram of account data
12.1.1 An overall information security policy is: • Established. • Published. • Maintained. • Disseminated to all relevant personnel, as well as to relevant vendors and business partners
12.1.2 The information security policy is: • Reviewed at least once every 12 months. • Updated as needed to reflect changes to business objectives or risks to the environment
3.6.1.1 Documented description of cryptographic architecture

SOC 2 · 5 controls

SOC2-CC3.1 COSO principle 6: Specifies objectives to identify and assess risks
SOC2-CC5.1 COSO principle 10: Selects and develops control activities to mitigate risks
SOC2-CC5.2 COSO principle 11: Selects and develops general controls over technology
SOC2-CC6.1 Implements logical access security software, infrastructure and architectures over protected information assets
SOC2-P6.4 Obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity's objectives related to privacy. The entity assesses those parties' compliance on a periodic and as-needed

CIS Controls v8 · 4 controls

CIS-12.2 Establish and Maintain a Secure Network Architecture
CIS-12.4 Establish and Maintain Architecture Diagram(s)
CIS-16.10 Apply Secure Design Principles in Application Architectures
CIS-3.8 Document Data Flows

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

CCM-AIS-04 Secure Application Design and Development
CCM-DSP-05 Data Flow Documentation
CCM-DSP-07 Data Protection by Design and Default
CCM-IVS-08 Network Architecture Documentation

ISO 27001:2022 · 4 controls

5.1 Policies for information security
5.35 Independent review of information security
8.27 Secure system architecture and engineering principles
8.32 Change management

ISO 27002:2022 · 4 controls

5.1 Policies for information security
5.35 Independent review of information security
5.8 Information security in project management
8.27 Secure system architecture and engineering principles

NIST SP 800-53 Rev 5 · 3 controls

NIST800-PL-8 Security and privacy architectures
NIST800-SA-17 Developer Security and Privacy Architecture and Design. Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that: Is consistent with the organization's
NIST800-SA-22 Unsupported System Components

Azure Security Benchmark · 2 controls

ASBv3-GS-2 Define and implement enterprise segmentation/separation of duties strategy
ASBv3-GS-4 Define and implement network security strategy

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-04 Identify the Most Sensitive Information and Servers and Maintain a Network Diagram

C5 (Germany) · 1 control

C5-COS-07 Documentation of the network topology

CMMC 2.0 · 1 control

SC.L2-3.13.2 Security Engineering

GDPR · 1 control

GDPR-Art.25 Data protection by design and by default

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-ID.AM-03 Representations of the organization's authorized network communication and internal and external network data flows are maintained

NIST SP 800-161 Rev 1 · 1 control

161R1-PL-8 Security and Privacy Architectures

NIST SP 800-171 Rev 3 · 1 control

03.16.01 Security Engineering Principles

NIST SP 800-172 · 1 control

3.11.4e Security Solution Rationale Document

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.