Crossfoot
Crossfoot / Controls / Security governance and policies
Draft v0.1.06 of 6 frameworks

Security governance and policies

Documented, approved and communicated information security policies with management oversight.

Where it appears

SOC 2
CC1.1Demonstrates commitment to integrity and ethical values
CC1.2Board exercises oversight responsibility
CC5.3Deploys control activities through policies and procedures
PCI DSS 4.0
12.1A comprehensive information security policy is established, published, maintained and disseminated
12.4PCI DSS compliance is managed
NIST CSF 2.0
GV.POPolicy
GV.OVOversight
ISO 27001:2022
A.5.1Policies for information security
A.5.36Compliance with policies, rules and standards for information security
HIPAA Security Rule
164.308(a)(1)(i)Security management process
164.316(a)Policies and procedures
NIST 800-53 r5
PM-1Information security program plan
PL-1Policy and procedures (planning)

Evidence auditors usually ask for

A typical starting list. Your assessor's request list is the one that counts.

  • Information security policy with version history and approval signature/date
  • Evidence policies were reviewed within the last 12 months
  • Policy acknowledgement records for employees
  • Management or board meeting minutes showing security reporting

Crosswalks that include this

SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0