Sigstore - Software Artifact Signing and Verification SIGSTORE-COS-2: Key-Based Signing

What else in your programme already covers this

This control maps to 83 controls across 40 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 3 controls

CPG-3.A Log Collection
CPG-3.B Secure Log Storage
CPG-8.C Encrypted DNS

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 3 controls

MD124-CTL-02 Device Encryption
MD124-POL-03 Mobile Data Protection Policy
MD124-TECH-05 VPN and Secure Communication

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 3 controls

FEDRAMP-SC-13 Cryptographic Protection
FEDRAMP-SC-28 Protection of Information at Rest
FEDRAMP-SC-8 Transmission Confidentiality and Integrity

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

AWWA-3.2 Remote Access Security
AWWA-3.4 Encryption and Data Protection

FBI CJIS Security Policy · 2 controls

CJIS-8 Media Protection
CJIS-9 System and Communications Protection

ISO 13485 · 2 controls

ISO13485-02 ePHI encryption at rest and in transit
ISO13485-16 Transmission security and encryption

ISO 27043 · 2 controls

ISO27043-17 Encryption of data at rest
ISO27043-18 Encryption of data in transit

ISO 27799 · 2 controls

ISO27799-02 ePHI encryption at rest and in transit
ISO27799-16 Transmission security and encryption

ISO/SAE 21434 · 2 controls

ISO21434-17 Encryption of data at rest
ISO21434-18 Encryption of data in transit

US ITAR and EAR - Export Control and Data Security · 2 controls

US-ITAR-EAR-DS-01 Technical Data Protection
US-ITAR-EAR-DS-02 Cloud and Storage

3GPP 5G Security Architecture (TS 33.501) · 1 control

TS33.501-6.6 AS Security

APPI · 1 control

APPI-A34 Request for Correction, Addition or Deletion

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

ASD37-17 TLS encryption between email servers (Limited)

BSI IT-Grundschutz · 1 control

BSI-08 Cryptographic protection of data

Bahrain PDPL · 1 control

BH-PDPL-13 Encryption of personal data

FFIEC IT Examination Handbook · 1 control

FFIEC-09 Encryption and key management

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5)

IEC 62351 - Power Systems Communication Security · 1 control

62351-9 Cyber security key management

ISO 27017 · 1 control

ISO27017-12 Encryption of cloud-stored data

ISO 27018 · 1 control

ISO27018-12 Encryption of cloud-stored data

ISO/IEC 27400:2022 · 1 control

27400-6.2 Device Identity and Authentication

MARS-E - Minimum Acceptable Risk Standards for Exchanges · 1 control

MARSE-SC-02 Federal Tax Information Protection

NIST SP 800-190 · 1 control

NIST190-12 Encryption of cloud-stored data

NIST SP 800-53 Rev 5 · 1 control

NIST800-SC-13 Cryptographic protection

PCI P2PE · 1 control

PCI-P2PE-09 Encryption and key management

PCI PIN Security · 1 control

PCI-PIN-09 Encryption and key management

PCI SSF · 1 control

PCI-SSF-09 Encryption and key management

SLSA · 1 control

SUPCHAIN-2 Source Integrity - Branch Protection, Code Review, Two-Person Rule

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

SOC-CY-C2 Encryption and Data Protection

Saudi Arabia PDPL · 1 control

SA-PDPL-13 Encryption of personal data

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

IM8-CLD.2 Cloud Security Controls

South Korea ISMS-P · 1 control

ISMSP-SYS-02 Encryption Implementation

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

CH-FADP-13 Right to object and request blocking

TISAX - Trusted Information Security Assessment Exchange · 1 control

TISAX-TECH-02 Cryptography

Taiwan PDPA · 1 control

TAIWAN-2 Consent, Notice, Sensitive Data

Texas Data Privacy Act · 1 control

TEXASTDPSA-2 Consumer Rights

UK Open Banking Standard · 1 control

OB-SEC.2 Transport Layer Security

Uruguay DPL · 1 control

URUGUAY-3 Sensitive Data, Health Data, Children

Virginia CDPA · 1 control

VIRGINIAVCDPA-2 Consumer Rights

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.