SOC 2 SOC2-CC4.1: COSO principle 16: Selects and develops ongoing and separate evaluations

What else in your programme already covers this

This control maps to 250 controls across 40 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 27 controls

1.2.7 NSC rule sets reviewed every six months
10.4.2.1 Frequency defined by TRA
11.3.1 Internal vulnerability scans quarterly
11.3.1.2 Authenticated internal scans
11.3.1.3 Internal scans after significant changes
11.3.2.1 External scans after significant change
11.4.2 Internal penetration testing annually
11.4.4 Pen test findings remediated
12.1.2 The information security policy is: • Reviewed at least once every 12 months. • Updated as needed to reflect changes to business objectives or risks to the environment
12.10.2 IRP reviewed and tested annually
12.10.4.1 Periodic IR responder skill review
12.10.6 IRP refined based on lessons learned
12.3.2 TRA for customized approach
12.3.3 Cryptographic cipher suites and protocols inventory
12.4.2 Quarterly PCI compliance reviews (SP)
12.4.2.1 Documentation of quarterly reviews (SP)
12.5.2 PCI DSS scope documented and confirmed annually
4.1.1 All security policies and operational procedures that are identified in Requirement 4 are: • Documented. • Kept up to date. • In use. • Known to all affected parties
5.2.3.1 Frequency of periodic evaluations per targeted risk analysis
6.2.3.1 Code review findings corrected
7.1.1 All security policies and operational procedures that are identified in Requirement 7 are: • Documented. • Kept up to date. • In use. • Known to all affected parties
7.2.5.1 App and system account review cadence
9.4.1.1 Offline media backup security
9.4.5.1 Inventories of electronic media with cardholder data are conducted at least once every 12 months
3.1.1 All security policies and operational procedures that are identified in Requirement 3 are: • Documented. • Kept up to date. • In use. • Known to all affected parties
6.4.3 All payment page scripts that are loaded and executed in the consumer's browser are managed as follows: • A method is implemented to confirm that each script is authorized. • A method is implemented
7.2.4 All user accounts and related access privileges, including third-party/vendor accounts, are reviewed as follows: • At least once every six months. • To ensure user accounts and access remain appropriate based on job function.

NIST SP 800-53 Rev 5 · 20 controls

NIST800-AT-6 Training feedback
NIST800-AU-6 Audit record review, analysis, and reporting
NIST800-CA-1 Policy and procedures for assessment, authorization, and monitoring
NIST800-CA-2 Control assessments
NIST800-CA-6 Authorization
NIST800-CA-7 Continuous monitoring
NIST800-CA-8 Penetration testing
NIST800-IR-4 Incident handling
NIST800-PL-1 Policy and procedures for planning
NIST800-PM-1 Information Security Program Plan. Develop and disseminate an organization-wide information security program plan that: Provides an overview of the requirements for the security program and a description of the security program management controls and
NIST800-PM-14 Testing, Training, and Monitoring. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems: Are developed and maintained; and Continue to be
NIST800-PM-24 Data Integrity Board. Establish a Data Integrity Board to: Review proposals to conduct or participate in a matching program; and Conduct an annual review of all matching programs in which the agency has participated
NIST800-PM-31 Continuous Monitoring Strategy. Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: Establishing the following organization-wide metrics to be monitored: [organization-defined]; Establishing [organization-defined] and [organization-defined] for control effectiveness; Ongoing monitoring
NIST800-PM-6 Measures of Performance. Develop, monitor, and report on the results of information security and privacy measures of performance
NIST800-RA-1 Policy and procedures for risk assessment
NIST800-SI-4 System monitoring
NIST800-SI-6 Security and Privacy Function Verification. Verify the correct operation of [organization-defined]; Perform the verification of the functions specified in SI-6a [organization-defined]; Alert [organization-defined] to failed security and privacy verification tests; and [organization-defined] when anomalies
SP800-53-CA Assessment, Authorization, and Monitoring Family
SP800-53-PL Planning Family
SP800-53-PM Program Management Family

FedRAMP High · 16 controls

AC-2 Account Management
AC-6(7) Review of User Privileges
CA-1 Policy and Procedures
CA-2 Control Assessments
CA-6 Authorization
CA-7 Continuous Monitoring
CA-7(1) Independent Assessment
CA-7(4) Continuous Monitoring | Risk Monitoring. Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (a) Effectiveness monitoring; (b) Compliance monitoring; and (c) Change monitoring
CA-8 Penetration Testing
CA-8(1) Penetration Testing | Independent Penetration Testing Agent or Team. Employ an independent penetration testing agent or team to perform penetration testing on the system or system components
CP-9(1) Testing for Reliability and Integrity
IR-3(2) Incident Response Testing | Coordination with Related Plans. Coordinate incident response testing with organizational elements responsible for related plans
PL-1 Policy and Procedures
PL-2 System Security and Privacy Plans
RA-3 Risk Assessment
SI-2(2) Automated Flaw Remediation Status

FedRAMP Moderate · 16 controls

AC-2 Account Management
AC-6(7) Review of User Privileges
CA-1 Policy and Procedures
CA-2 Control Assessments
CA-6 Authorization
CA-7 Continuous Monitoring
CA-7(1) Independent Assessment
CA-7(4) Continuous Monitoring | Risk Monitoring. Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (a) Effectiveness monitoring; (b) Compliance monitoring; and (c) Change monitoring
CA-8 Penetration Testing
CA-8(1) Penetration Testing | Independent Penetration Testing Agent or Team. Employ an independent penetration testing agent or team to perform penetration testing on the system or system components
CP-9(1) Testing for Reliability and Integrity
IR-3(2) Incident Response Testing | Coordination with Related Plans. Coordinate incident response testing with organizational elements responsible for related plans
PL-1 Policy and Procedures
PL-2 System Security and Privacy Plans
RA-3 Risk Assessment
SI-2(2) Automated Flaw Remediation Status

ISO 22301:2019 · 15 controls

10.1 Nonconformity and corrective action
4.4 Business continuity management system
6.1 Actions to address risks and opportunities
7.5 Documented information
7.5.3 Control of documented information
8.1 Operational planning and control
8.2.1 General
8.3.1 General
8.5 Exercise programme
8.6 Evaluation of business continuity documentation and capabilities
9.1 Monitoring, measurement, analysis and evaluation
9.2 Internal audit
9.2.1 General
9.2.2 Audit programme(s)
9.3.1 General

NIST SP 800-53 Revision 5.1 HIGH · 13 controls

AC-2 Account Management
AC-6(7) Review of User Privileges
CA-1 Policy and Procedures
CA-2 Control Assessments
CA-6 Authorization
CA-7 Continuous Monitoring
CA-7(1) Independent Assessment
CA-7(4) Continuous Monitoring | Risk Monitoring. Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (a) Effectiveness monitoring; (b) Compliance monitoring; and (c) Change monitoring
CA-8 Penetration Testing
CP-9(1) Testing for Reliability and Integrity
PL-1 Policy and Procedures
PL-2 System Security and Privacy Plans
RA-3 Risk Assessment

CIS Controls v8 · 12 controls

CIS-11.5 Test Data Recovery
CIS-14.7 Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates
CIS-16.13 Conduct Application Penetration Testing
CIS-16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities
CIS-18.1 Establish and Maintain a Penetration Testing Program
CIS-18.2 Perform Periodic External Penetration Tests
CIS-18.4 Validate Security Measures
CIS-18.5 Perform Periodic Internal Penetration Tests
CIS-5.5 Establish and Maintain an Inventory of Service Accounts
CIS-7.1 Establish and Maintain a Vulnerability Management Process
CIS-7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets
CIS-7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets

NIST SP 800-53 Rev 5 MODERATE · 12 controls

AC-2 Account Management
AC-6(7) Review of User Privileges
CA-1 Policy and Procedures
CA-2 Control Assessments
CA-6 Authorization
CA-7 Continuous Monitoring
CA-7(1) Independent Assessment
CA-7(4) Continuous Monitoring | Risk Monitoring. Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (a) Effectiveness monitoring; (b) Compliance monitoring; and (c) Change monitoring
CP-9(1) Testing for Reliability and Integrity
PL-1 Policy and Procedures
PL-2 System Security and Privacy Plans
RA-3 Risk Assessment

ISO 27701:2019 · 10 controls

5.6.2 Information security risk assessment
5.7 Performance evaluation
5.7.1 Monitoring, measurement, analysis and evaluation
5.7.2 Internal audit
5.8 Improvement
5.8.1 Nonconformity and corrective action
5.8.2 Continual improvement
6.15.2 Information security reviews
6.9.1 Operational procedures and responsibilities
6.9.7 Information systems audit considerations

NIST Cybersecurity Framework 2.0 · 10 controls

NIST-CSF-DE.CM-01 Networks and network services are monitored to find potentially adverse events
NIST-CSF-GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction
NIST-CSF-GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks
NIST-CSF-GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
NIST-CSF-ID.IM-01 Improvements are identified from evaluations
NIST-CSF-ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
NIST-CSF-ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities
NIST-CSF-ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established
NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use

NIST SP 800-53 Rev 5 LOW · 9 controls

AC-2 Account Management
CA-1 Policy and Procedures
CA-2 Control Assessments
CA-6 Authorization
CA-7 Continuous Monitoring
CA-7(4) Continuous Monitoring | Risk Monitoring. Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (a) Effectiveness monitoring; (b) Compliance monitoring; and (c) Change monitoring
PL-1 Policy and Procedures
PL-2 System Security and Privacy Plans
RA-3 Risk Assessment

ISO/IEC 42001:2023 · 8 controls

10.1 Continual improvement
4.4 Management system
8.3 AI risk treatment
9.1 Monitoring, measurement, analysis and evaluation
9.2 Internal audit
9.2.1 General
9.2.2 Internal audit programme
9.3 Management review

ISO 27001:2022 · 6 controls

5.22 Monitoring, review and change management of supplier services
5.35 Independent review of information security
5.36 Compliance with policies, rules and standards for information security
8.16 Monitoring activities
8.29 Security testing in development and acceptance
8.32 Change management

ISO 27002:2022 · 6 controls

5.22 Monitoring, review and change management of supplier services
5.28 Collection of evidence
5.35 Independent review of information security
5.36 Compliance with policies, rules and standards for information security
8.16 Monitoring activities
8.32 Change management

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 5 controls

CFTC-SS-15 Controls Testing
CFTC-SS-18 Independence of Testers
CFTC-SS-33 Regular Periodic Objective Testing and Review of Automated Systems
CFTC-SS-34 Internal Penetration Testing
CFTC-SS-35 Scope of Testing and Assessment

CMMC 2.0 · 5 controls

AU.L2-3.3.3 Event Review
CA.L2-3.12.1 Security Control Assessment
CA.L2-3.12.3 Security Control Monitoring
IR.L2-3.6.3 Incident Response Testing
RA.L2-3.11.2 Vulnerability Scan

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 5 controls

CCM-A&A-01 Audit and Assurance Policy and Procedures
CCM-A&A-02 Independent Assessments
CCM-A&A-03 Risk Based Planning Assessment
CCM-A&A-05 Audit Management Process
CCM-STA-11 Internal Compliance Testing

APRA CPS 220 Risk Management · 4 controls

CPS220-11 Annual Audit Review of the Framework
CPS220-18 Triennial Comprehensive Review of the Framework
CPS220-P46 Scope of the Comprehensive Review
CPS220-P47 Minimum Assessment Required by the Framework Review

APRA CPS 230 Operational Risk Management · 4 controls

CPS230-16 Internal Audit Review of the Business Continuity Plan
CPS230-49 Internal Audit Review of Proposed Critical Operation Outsourcing
CPS230-66 Review of Operational Risk Management
CPS230-P30 Monitoring, Review and Testing of Control Effectiveness

APRA CPS 234 · 4 controls

CPS234-22 Systematic Control Testing Program
CPS234-25 Internal Audit Review of Information Security Controls
CPS234-P30 Independence and Skill of Testing Personnel
CPS234-P31 Annual Review of Testing Program Sufficiency

C5 (Germany) · 4 controls

C5-COM-02 Policy for planning and conducting audits
C5-COM-03 Internal audits of the information security management system
C5-OPS-19 Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests
C5-OPS-20 Managing Vulnerabilities, Malfunctions and Errors - Measurements, Analyses and Assessments of Procedures

Azure Security Benchmark · 3 controls

ASBv3-GS-5 Define and implement security posture management strategy
ASBv3-PV-7 Conduct regular red team operations
PV-2 Audit and enforce secure configurations

DORA · 3 controls

DORA-Art.24 General requirements for the performance of digital operational resilience testing
DORA-Art.50 Administrative penalties and remedial measures
DORA-Art.6 ICT risk management framework

EU AI Act · 3 controls

EUAI-Art.17 Quality management system
EUAI-Art.43 Conformity assessment
EUAI-Art.72 Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems

HIPAA Security Rule · 3 controls

164.308(a)(1)(i) Security Management Process (Standard)
164.308(a)(1)(ii)(D) Information System Activity Review (Required)
164.308(a)(8) Evaluation (Standard)

NIST SP 800-171 Rev 3 · 3 controls

03.11.02 Vulnerability Monitoring and Scanning
03.12.01 Security Assessment
03.12.03 Continuous Monitoring

NIST SP 800-53A Rev. 5 · 3 controls

53A-3.1 Prepare for Control Assessments
53A-3.3 Conduct Control Assessments
53A-F Ongoing Assessment and Automation

NIST SP 800-66 Rev 2 · 3 controls

164.308(a)(1)(i) Security Management Process (Standard)
164.308(a)(1)(ii)(D) Information System Activity Review (Required)
164.308(a)(8) Evaluation (Standard)

AWS Well-Architected Security Pillar · 2 controls

SEC02-BP05 Audit and rotate credentials periodically
SEC11-BP03 Perform regular penetration testing

Australia My Health Records Act 2012 · 2 controls

MYHR-SEC-3 Audit logging and access monitoring
MYHR-SEC-5 Security risk assessment

Authorised Economic Operator (AEO) Programmes - Global Standards · 2 controls

AEO-13 Measurement, Analyses and Improvement
P2-S1 Partnership

GDPR · 2 controls

GDPR-Art.24 Responsibility of the controller
GDPR-Art.32 Security of processing

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI) · 2 controls

171A-03.12.01 Security Assessment
171A-03.12.03 Continuous Monitoring

NIST SP 800-172 · 2 controls

3.11.5e Assess Effectiveness of Security Solutions
3.12.1e Penetration Testing by Independent Agents

ACSC Essential Eight · 1 control

E8-APP-ML2 Application Control (ML2)

AICPA SOC 3 · 1 control

SOC3-MONITORING Monitoring Controls

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-38 Carry Out Regular Security Checks and Audits and Apply the Corrective Actions

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-STEP4 Step 4 - Implement a formal controls assessment program

NIS2 Directive · 1 control

Art.21.2.f Policies and procedures to assess the effectiveness of the cybersecurity risk-management measures

NIST SP 800-161 Rev 1 · 1 control

161R1-CA-2 Control Assessments

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.