NIST CSF 2.0 to SOC 2 crosswalk

29 control objectives in NIST Cybersecurity Framework are mapped here to SOC 2 Trust Services Criteria. Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.

Control objective	NIST CSF 2.0	SOC 2
Security governance and policies	`GV.PO`Policy `GV.OV`Oversight	`CC1.1`Demonstrates commitment to integrity and ethical values `CC1.2`Board exercises oversight responsibility `CC5.3`Deploys control activities through policies and procedures
Security roles and accountability	`GV.RR`Roles, responsibilities and authorities	`CC1.3`Establishes structure, authority and responsibility `CC1.5`Enforces accountability
Risk assessment and treatment	`GV.RM`Risk management strategy `ID.RA`Risk assessment	`CC3.1`Specifies suitable objectives `CC3.2`Identifies and analyzes risk `CC3.3`Considers potential for fraud `CC3.4`Identifies and assesses significant changes
Asset and system inventory	`ID.AM`Asset management	`CC6.1`Logical access security (inventory of information assets is a point of focus)
Data classification and handling	`ID.AM-07`Inventories of data and corresponding metadata are maintained `PR.DS`Data security	`C1.1`Identifies and maintains confidential information
Access provisioning, review and removal	`PR.AA-05`Access permissions, entitlements and authorizations are defined and managed (least privilege, separation of duties)	`CC6.2`Registers and authorizes new users prior to issuing credentials `CC6.3`Authorizes, modifies or removes access based on roles
Least privilege and privileged access	`PR.AA-05`Access permissions managed incorporating least privilege	`CC6.3`Role-based access and least privilege
Authentication, unique IDs and multi-factor authentication	`PR.AA-03`Users, services and hardware are authenticated	`CC6.1`Logical access security software, infrastructure and architectures
Encryption at rest and key management	`PR.DS-01`The confidentiality, integrity and availability of data-at-rest are protected	`CC6.1`Logical access security (encryption of data at rest)
Encryption in transit	`PR.DS-02`The confidentiality, integrity and availability of data-in-transit are protected	`CC6.7`Restricts transmission, movement and removal of information
Network security and segmentation	`PR.IR-01`Networks and environments are protected from unauthorized logical access and usage	`CC6.6`Implements logical access security measures against threats from outside system boundaries
Secure configuration and hardening	`PR.PS-01`Configuration management practices are established and applied	`CC7.1`Uses detection and monitoring procedures to identify changes to configurations
Vulnerability scanning and patching	`ID.RA`Risk assessment (vulnerability identification, ID.RA-01) `PR.PS-02`Software is maintained, replaced and removed commensurate with risk	`CC7.1`Detection and monitoring procedures identify vulnerabilities
Penetration testing and independent assessment	`ID.IM`Improvement (incl. ID.IM-02, improvements from tests and exercises)	`CC4.1`Selects, develops and performs ongoing and/or separate evaluations `CC7.1`Detection and monitoring procedures
Logging, log review and monitoring	`DE.CM`Continuous monitoring `PR.PS-04`Log records are generated and made available for continuous monitoring	`CC7.2`Monitors system components for anomalies indicative of malicious acts, natural disasters and errors
Intrusion detection and integrity monitoring	`DE.CM`Continuous monitoring `DE.AE`Adverse event analysis	`CC7.2`Monitors system components for anomalies `CC6.8`Prevents or detects unauthorized or malicious software
Malware protection	`PR.PS-05`Installation and execution of unauthorized software are prevented `DE.CM`Continuous monitoring	`CC6.8`Implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software
Incident response and breach notification	`RS.MA`Incident management `RS.AN`Incident analysis `RS.CO`Incident response reporting and communication `RS.MI`Incident mitigation `DE.AE`Adverse event analysis	`CC7.3`Evaluates security events to determine whether they are incidents `CC7.4`Responds to identified security incidents `CC7.5`Identifies, develops and implements activities to recover from incidents
Change management	`PR.PS-01`Configuration management practices are established and applied	`CC8.1`Authorizes, designs, develops, configures, documents, tests, approves and implements changes
Secure software development	`PR.PS-06`Secure software development practices are integrated and their performance monitored	`CC8.1`Changes are developed, tested and approved
Third-party and vendor risk management	`GV.SC`Cybersecurity supply chain risk management	`CC9.2`Assesses and manages risks associated with vendors and business partners
Business continuity and disaster recovery	`PR.IR-03`Mechanisms are implemented to achieve resilience requirements `RC.RP`Incident recovery plan execution	`CC9.1`Identifies, selects and develops risk mitigation activities for business disruptions `A1.2`Environmental protections, software, data backup processes and recovery infrastructure `A1.3`Tests recovery plan procedures
Backup and redundancy	`PR.DS-11`Backups of data are created, protected, maintained and tested	`A1.2`Data backup processes and recovery infrastructure
Capacity and availability management	`PR.IR-04`Adequate resource capacity to ensure availability is maintained	`A1.1`Maintains, monitors and evaluates current processing capacity
Security awareness and training	`PR.AT`Awareness and training	`CC1.4`Demonstrates commitment to attract, develop and retain competent individuals `CC2.2`Internally communicates information necessary to support internal control
Personnel screening, terms and sanctions	`GV.RR-04`Cybersecurity is included in human resources practices	`CC1.4`Hiring and competence practices `CC6.3`Removes access on termination
Physical access and facility security	`PR.AA-06`Physical access to assets is managed, monitored and enforced commensurate with risk	`CC6.4`Restricts physical access to facilities and protected information assets
Data retention, media handling and secure disposal	`ID.AM-08`Systems, hardware, software, services and data are managed throughout their life cycles	`CC6.5`Discontinues logical and physical protections over assets only after the ability to read or recover data is diminished `C1.2`Disposes of confidential information
Ongoing control monitoring and internal audit	`ID.IM`Improvement `GV.OV`Oversight	`CC4.1`Selects, develops and performs ongoing and/or separate evaluations `CC4.2`Evaluates and communicates internal control deficiencies

Open a control objective for the evidence checklist.SOC 2 to NIST CSF 2.0 →

Scope: Mapped at category level (e.g. PR.AA) or subcategory where one is clearly the match (e.g. PR.AA-05). Security (CC series), Availability (A1) and Confidentiality (C1). Processing Integrity and Privacy are not covered in this dataset version. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from NIST CSF 2.0

NIST CSF 2.0 to PCI DSS 4.0 NIST CSF 2.0 to ISO 27001:2022 NIST CSF 2.0 to HIPAA Security Rule NIST CSF 2.0 to NIST 800-53 r5