SOC 2 to CISA Cybersecurity Performance Goals Mapping

monitoring

7 controls

a1-1

Capacity is managed to ensure system availability

cc2-1

Relevant security information is obtained and used

cc4-1

Security controls are evaluated on an ongoing basis

cc4-2

Control deficiencies are identified, evaluated, and communicated

cc7-2

Anomalies and security events are detected and monitored

rr-4

Security logs are collected centrally and retained for investigation

rr-5

Network and system anomalies are monitored and alerted on

incident-response

7 controls

cc7-3

Detected security incidents are evaluated and classified

cc7-4

Security incidents are responded to and contained

cc7-5

Incidents are recovered from and resumption of operations is documented

aa-4

Credentials are revoked immediately on known or suspected compromise

rr-1

An incident response plan is documented and maintained

rr-2

Incident response roles and contacts are designated and current

rr-6

Incident response exercises are conducted at least annually

governance

5 controls

cc1-1

Commitment to integrity and ethical values is demonstrated

cc1-2

Board or equivalent body oversees security risk

cc1-3

Organizational structure and authority for security is defined

cc5-3

Controls are deployed through policies and procedures

gov-1

A cybersecurity policy is established, approved, and communicated

documentation

5 controls

cc2-2

Security information is communicated internally

cc5-1

Control activities are selected and developed to mitigate risks

cc5-3

Controls are deployed through policies and procedures

gov-1

A cybersecurity policy is established, approved, and communicated

rr-1

An incident response plan is documented and maintained

recovery

4 controls

a1-3

Recovery procedures restore system availability after disruptions

cc7-5

Incidents are recovered from and resumption of operations is documented

da-5

Backups of critical data are maintained and tested

rr-7

Recovery procedures are documented and tested

data-protection

4 controls

c1-1

Confidential information is identified and protected

cc6-7

Sensitive data is protected during transmission and storage

da-3

Data in transit is encrypted using modern protocols

ds-6

Full-disk encryption is enforced on all endpoints and portable storage

supply-chain

4 controls

cc9-2

Third-party vendor risk is assessed and managed

gov-4

Third-party vendors are required to meet minimum security standards

sc-1

Third-party software and services are inventoried and assessed for risk

sc-2

Vendor contracts include minimum cybersecurity requirements

disaster-recovery

3 controls

a1-3

Recovery procedures restore system availability after disruptions

da-5

Backups of critical data are maintained and tested

rr-7

Recovery procedures are documented and tested

awareness

3 controls

cc1-4

Commitment to competence in security is demonstrated

cc2-2

Security information is communicated internally

gov-3

Employees are trained to recognize and report phishing attempts

logging

3 controls

cc2-1

Relevant security information is obtained and used

cc7-2

Anomalies and security events are detected and monitored

rr-4

Security logs are collected centrally and retained for investigation

remediation

3 controls

cc4-2

Control deficiencies are identified, evaluated, and communicated

vm-1

Vulnerability scanning is performed regularly on all systems

vm-3

Critical and high vulnerabilities are remediated within defined SLAs

mfa

3 controls

cc6-1

Logical access security measures restrict access to assets

aa-1

Multi-factor authentication is required for all user accounts

aa-5

Phishing-resistant MFA is enforced for privileged and high-value accounts

authentication

3 controls

cc6-1

Logical access security measures restrict access to assets

aa-1

Multi-factor authentication is required for all user accounts

aa-6

Strong password policies are enforced at the identity provider, including breached-password checks

least-privilege

3 controls

cc6-1

Logical access security measures restrict access to assets

cc6-3

Role-based access is used and reviewed periodically

aa-3

Privileged accounts are separated and access is minimized

encryption

3 controls

cc6-7

Sensitive data is protected during transmission and storage

da-2

Sensitive data at rest is encrypted using current standards

ds-6

Full-disk encryption is enforced on all endpoints and portable storage

vulnerability-management

3 controls

cc7-1

Vulnerability management identifies and remediates security flaws

ds-5

Critical and high CVEs are patched within 14 days; all others within 30 days

vm-3

Critical and high vulnerabilities are remediated within defined SLAs

patching

3 controls

cc7-1

Vulnerability management identifies and remediates security flaws

ds-5

Critical and high CVEs are patched within 14 days; all others within 30 days

vm-2

CISA Known Exploited Vulnerabilities are remediated on priority timelines

siem

3 controls

cc7-2

Anomalies and security events are detected and monitored

rr-4

Security logs are collected centrally and retained for investigation

rr-5

Network and system anomalies are monitored and alerted on

third-party

3 controls

cc9-2

Third-party vendor risk is assessed and managed

gov-4

Third-party vendors are required to meet minimum security standards

sc-1

Third-party software and services are inventoried and assessed for risk

data-classification

2 controls

c1-1

Confidential information is identified and protected

da-1

Sensitive data is inventoried and classified by type

pii

2 controls

c1-1

Confidential information is identified and protected

da-1

Sensitive data is inventoried and classified by type

data-retention

2 controls

c1-2

Confidential information is disposed of securely

da-4

Sensitive data is securely disposed of when no longer needed

data-disposal

2 controls

c1-2

Confidential information is disposed of securely

da-4

Sensitive data is securely disposed of when no longer needed

policy

2 controls

cc1-1

Commitment to integrity and ethical values is demonstrated

gov-1

A cybersecurity policy is established, approved, and communicated

roles

2 controls

cc1-3

Organizational structure and authority for security is defined

rr-2

Incident response roles and contacts are designated and current

training

2 controls

cc1-4

Commitment to competence in security is demonstrated

gov-2

All employees receive security awareness training at least annually

disclosure

2 controls

cc2-3

Security information is communicated to external parties

rr-3

Security incidents are reported to CISA when applicable

assessment

2 controls

cc3-2

Security risks are identified and analyzed

vm-1

Vulnerability scanning is performed regularly on all systems

insider-threat

2 controls

cc3-3

Fraud risk is identified and assessed

aa-7

Employee and contractor offboarding revokes all access within 24 hours

patch-management

2 controls

cc5-2

General controls over technology are selected and developed

vm-3

Critical and high vulnerabilities are remediated within defined SLAs

configuration

2 controls

cc5-2

General controls over technology are selected and developed

ds-2

Devices are configured securely with hardened baselines

offboarding

2 controls

cc6-5

Access is removed or modified when no longer required

aa-7

Employee and contractor offboarding revokes all access within 24 hours

firewall

2 controls

cc6-6

Logical access security measures protect against external threats

ds-3

Network segmentation isolates critical systems

tls

2 controls

cc6-7

Sensitive data is protected during transmission and storage

da-3

Data in transit is encrypted using modern protocols

malware

2 controls

cc6-8

Controls protect against malicious software

ds-4

Endpoint detection and response (EDR) is deployed on all managed devices

endpoint-protection

2 controls

cc6-8

Controls protect against malicious software

ds-4

Endpoint detection and response (EDR) is deployed on all managed devices

edr

2 controls

cc6-8

Controls protect against malicious software

ds-4

Endpoint detection and response (EDR) is deployed on all managed devices

cve

2 controls

cc7-1

Vulnerability management identifies and remediates security flaws

ds-5

Critical and high CVEs are patched within 14 days; all others within 30 days

anomaly-detection

2 controls

cc7-2

Anomalies and security events are detected and monitored

rr-5

Network and system anomalies are monitored and alerted on

tabletop

2 controls

cc7-4

Security incidents are responded to and contained

rr-6

Incident response exercises are conducted at least annually

vendor-risk

2 controls

cc9-2

Third-party vendor risk is assessed and managed

sc-1

Third-party software and services are inventoried and assessed for risk