Crossfoot
Crossfoot / Controls / Ongoing control monitoring and internal audit
Draft v0.1.06 of 6 frameworks

Ongoing control monitoring and internal audit

Controls are periodically evaluated for effectiveness; deficiencies are tracked and communicated to management.

Where it appears

SOC 2
CC4.1Selects, develops and performs ongoing and/or separate evaluations
CC4.2Evaluates and communicates internal control deficiencies
PCI DSS 4.0
12.4.2Reviews confirm personnel perform tasks per policy (service providers)
NIST CSF 2.0
ID.IMImprovement
GV.OVOversight
ISO 27001:2022
Clause 9.2Internal audit
Clause 9.3Management review
HIPAA Security Rule
164.308(a)(8)Evaluation
NIST 800-53 r5
CA-2Control assessments
CA-7Continuous monitoring

Evidence auditors usually ask for

A typical starting list. Your assessor's request list is the one that counts.

  • Internal audit or control self-assessment plan and results
  • Deficiency / corrective action tracking
  • Management review meeting minutes
  • For PCI service providers: quarterly confirmation that personnel are performing security tasks (12.4.2)

Crosswalks that include this

SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0