ABCDEFGHIJKLMNOPQRSTUVWXYZ
1
2
3
Control Mapping for SOC 2, ISO 27001 and ISO 27002
4
Strike Graph-suggested name of controlSOC 2:2017 (2022) Reference
CC: Common Criteria (a.k.a. s: Security, c: continuity, pi: process integrity, p: privacy, a: availability)		ISO 27001:2022 & 27002 References
5
Acceptable Use PolicyCC 1.1Annex A.5.10
6
Administrator AccessCC 6.2, CC 6.3Annex A.5.15, Annex A.5.34
7
AntivirusCC 6.7, CC 6.8Annex A.5.32
8
Antivirus MaintenanceCC 7.2Annex A.8.16
9
Asset Decommission ChecklistCC 6.5Annex A.5.11, Annex A.7.14, Annex A.8.10
10
Asset InventoryCC 2.1, CC 6.1, C 1.1Annex A.5.9, Annex A.5.13, Annex A.5.32, Annex A.8.8
11
Audit Trail & LogsCC 6.8, CC 7.2Annex A.5.15, Annex A.8.4, Annex A.8.15, Annex A.8.16, Annex A.8.18
12
Automatic PatchingCC 8.1Annex A.8.19
13
Background CheckCC 1.4Annex A.6.1
14
Backup ScheduleCC 7.5, A 1.2, PI 1.5Annex A.8.13
15
Business ContinuityCC 8.1, CC 9.1, A 1.2, A 1.3Annex A.5.21, Annex A.5.29, Annex A.5.30
16
Business Impact AnalysisCC 3.2Annex A.5.29, Annex A.5.30
17
Capacity PlanningA 1.1Annex A.8.6
18
Change Management PolicyCC 5.2, CC 6.1, CC 6.8, CC 8.1Annex A.8.9, Annex A.8.25, Annex A.8.26, Annex A.8.29, Annex A.8.32
19
Change Management ProceduresCC 8.1, A 1.1Annex A.8.26, Annex A.8.29, Annex A.8.32
20
Change RestrictionsCC 7.1Annex A.8.9
21
Cloud Change MonitoringCC 4.1, CC 7.1, CC 7.2Annex A.8.16
22
Configuration StandardsCC 7.1, CC 8.1Annex A.8.27
23
Contacting CompanyP 8.1Annex A.5.34
24
Contract - Secure TransmissionCC 9.2Annex A.5.34
25
ContractsCC 2.3, CC 9.2, P 6.1, P 6.4Annex A.5.20, Annex A.5.31
26
Data AnonymizationP 4.2, P 4.3Annex A.8.11
27
Data Center Access ReviewCC 6.4Annex A.5.18
28
Data Center Physical AccessCC 6.4Annex A.7.2
29
Data CollectionP 3.1Annex A.8.11
30
Data Flow DiagramCC 2.1, CC 2.2, CC 6.1Annex A.5.34
31
Data Loss PreventionCC 6.7, C 1.1Annex A.8.12
32
Data Management PolicyCC 6.5, C 1.1, C 1.2, P 4.2, P 4.3Annex A.5.14, Annex A.5.33
33
Data Protection OfficerCC 1.3Annex A.5.34
34
Data ReplicationA 1.2Annex A.8.14, Annex A.8.20
35
Data Retention/DeletionCC 6.5, C 1.1, C 1.2, P 3.2, P 4.2, P 4.3Annex A.5.14, Annex A.5.33, Annex A.5.34, Annex A.8.10
36
Disciplinary ProcessCC 1.5Annex A.5.4, Annex A.6.4, Clause.7.3
37
Disk EncryptionCC 6.1Annex A.8.1
38
DMZ Network GatewayCC 6.1, CC 6.6Annex A.8.16
39
Edit ChecksPI 1.1, PI 1.2, PI 1.3Annex A.8.11
40
Employee Shared DriveCC 2.2Annex A.5.1, Annex A.5.37, Clause.5.2, Clause.7.5.3
41
Encryption at RestCC 6.1, PI 1.5Annex A.5.34
42
Encryption in TransitCC 6.1, CC 6.7, PI 1.4Annex A.8.24
43
Encryption Key ProtectionCC 6.1Annex A.8.11, Annex A.8.24
44
Environmental MonitoringA 1.2Annex A.7.5
45
Environmental RiskA 1.2Annex A.7.5, Clause.8.2
46
Environmental Security PolicyA 1.2Annex A.7.5
47
Fire SuppressionA 1.2Annex A.7.5, Annex A.7.8
48
Firewall AlertingCC 6.6, CC 7.1, CC 7.2Annex A.8.16, Annex A.8.21
49
Firewall RulesCC 6.6Annex A.6.7, Annex A.8.20, Annex A.8.23
50
GeneratorsA 1.2Annex A.7.11
51
Hardening StandardsCC 7.1Annex A.8.9., Annex A.8.19
52
HVAC TestingA 1.2Annex A.7.5
53
Incident Response: Employee ResponsibilityCC 2.2, CC 7.3, CC 7.4, P 8.1Annex A.5.24, Annex A.6.8
54
Incident Response: ProcessCC 2.3, CC 7.3, CC 7.4, CC 7.5Annex A.5.25, Annex A.5.26, Annex A.5.27, Annex A.5.28, Annex A.6.8
55
Incident Response: ResponsibilityCC 2.2, CC 7.4Annex A.5.24
56
Incident Response: TestingCC 7.4, CC 7.5Annex A.5.24
57
Information Security OversightCC 2.2Annex A.5.1, Clause.5.1
58
Information Security PolicyCC 5.3Annex A.5.1, Clause.5.1, Clause.5.2
59
Internal AuditCC 4.1Annex A.5.35, Annex A.5.36, Annex A.8.34, Clause.9.2.1, Clause.9.2.2
60
Intrusion DetectionCC 4.1, CC 6.6, CC 7.1, CC 7.2Annex A.8.16
61
Lawful BasisP 3.1, P 3.2, P 4.1, P 7.1Annex A.5.34
62
Logical AccessCC 5.2, CC 6.1, CC 6.3Annex A.5.15, Annex A.5.18, Annex A.8.2, Annex A.8.3, Annex A.8.5
63
Malware ScansCC 6.8Annex A.6.7, Annex A.8.7
64
Management Responsibilities in PoliciesCC 5.3Annex A.5.2
65
Media DisposalP 4.3Annex A.7.14
66
MFA for Sensitive AccessCC 6.1Annex A.8.5
67
Mobile Device PolicyCC 6.7Annex A.7.9, Annex A.8.1
68
MonitoringCC 4.1, CC 7.2Annex A.5.24
69
Multi-Factor AuthenticationCC 6.6Annex A.8.5
70
Network DiagramCC 2.1, CC 2.2Annex A.8.14, Annex A.8.20, Annex A.8.22
71
Non-Disclosure AgreementCC 9.2Annex A.5.4, Annex A.6.6
72
Organization Segregation of DutiesCC 1.3, CC 5.1Annex A.5.3
73
Organizational ChartCC 1.3Clause.5.1
74
Password RequirementsCC 6.2Annex A.5.17, Annex A.8.5
75
Patch ManagementCC 7.1Annex A.8.19
76
Penetration TestCC 4.1Annex A.8.8
77
Physical Access PolicyCC 6.4Annex A.5.15, Annex A.7.1
78
Physical Access ReviewCC 6.4Annex A.5.15
79
Planned MaintenanceCC 2.2Annex A.7.13
80
Policy ReviewCC 5.3Annex A.5.1, Clause.7.5.2
81
Power Supply TestingA 1.2Annex A.7.5, Annex A.7.11
82
Privacy NoticeCC 2.3, P 1.1, P 2.1, P 3.1, P 6.7Annex A.5.34
83
Privacy PolicyP 6.1, P 6.7, P 5.1Annex A.5.34
84
Privileged AccessCC 6.1, CC 6.2Annex A.8.2
85
Production Data RestrictionsCC 8.1Annex A.8.33
86
ProvisioningCC 6.1, CC 6.2, CC 6.3, CC 6.4Annex A.5.15, Annex A.5.16, Annex A.5.18
87
Raised FlooringA 1.2Annex A.7.8
88
Removable MediaCC 6.7Annex A.7.7, Annex A.7.10, Annex A.8.1
89
RestoreCC 7.4, CC 7.5, A 1.3Annex A.8.13
90
Restrict Data TransmissionCC 6.7Annex A.8.1
91
Restrict Software InstallCC 6.8Annex A.8.1, Annex A.8.7, Annex A.8.19
92
Review Privileged AccessCC 6.2, CC 6.3Annex A.5.18, Annex A.8.2
93
Risk Assessment Action PlansCC 3.2, CC 5.1Clause.8.2, Clause.8.3, Clause.6.1.3
94
Risk Assessment MethodologyCC 3.1, CC 3.2, CC 3.3, CC 3.4, CC 5.1, CC 9.2Annex A.5.12
95
Risk Assessment PolicyCC 3.2Clause.6.1.1
96
Role Based AccessCC 6.3Annex A.5.15, Annex A.5.34
97
Secrets ManagementCC 6.1Annex A.5.17
98
Security TrainingCC 2.2Annex A.5.4, Annex A.5.24, Annex A.6.3, Annex A.8.7, Annex A.8.23, Clause.7.3
99
Separation of Duties: DevelopersCC 8.1Annex A.8.4
100
Separation of EnvironmentsCC 8.1Annex A.8.31