Crossfoot / Crosswalks / SOC 2 to NIST CSF 2.0
Draft v0.1.029 of 29 objectives have a direct match
SOC 2 to NIST CSF 2.0 crosswalk
29 control objectives in SOC 2 Trust Services Criteria are mapped here to NIST Cybersecurity Framework. Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.
| Control objective | SOC 2 | NIST CSF 2.0 |
|---|---|---|
| Security governance and policies | CC1.1Demonstrates commitment to integrity and ethical valuesCC1.2Board exercises oversight responsibilityCC5.3Deploys control activities through policies and procedures | GV.POPolicyGV.OVOversight |
| Security roles and accountability | CC1.3Establishes structure, authority and responsibilityCC1.5Enforces accountability | GV.RRRoles, responsibilities and authorities |
| Risk assessment and treatment | CC3.1Specifies suitable objectivesCC3.2Identifies and analyzes riskCC3.3Considers potential for fraudCC3.4Identifies and assesses significant changes | GV.RMRisk management strategyID.RARisk assessment |
| Asset and system inventory | CC6.1Logical access security (inventory of information assets is a point of focus) | ID.AMAsset management |
| Data classification and handling | C1.1Identifies and maintains confidential information | ID.AM-07Inventories of data and corresponding metadata are maintainedPR.DSData security |
| Access provisioning, review and removal | CC6.2Registers and authorizes new users prior to issuing credentialsCC6.3Authorizes, modifies or removes access based on roles | PR.AA-05Access permissions, entitlements and authorizations are defined and managed (least privilege, separation of duties) |
| Least privilege and privileged access | CC6.3Role-based access and least privilege | PR.AA-05Access permissions managed incorporating least privilege |
| Authentication, unique IDs and multi-factor authentication | CC6.1Logical access security software, infrastructure and architectures | PR.AA-03Users, services and hardware are authenticated |
| Encryption at rest and key management | CC6.1Logical access security (encryption of data at rest) | PR.DS-01The confidentiality, integrity and availability of data-at-rest are protected |
| Encryption in transit | CC6.7Restricts transmission, movement and removal of information | PR.DS-02The confidentiality, integrity and availability of data-in-transit are protected |
| Network security and segmentation | CC6.6Implements logical access security measures against threats from outside system boundaries | PR.IR-01Networks and environments are protected from unauthorized logical access and usage |
| Secure configuration and hardening | CC7.1Uses detection and monitoring procedures to identify changes to configurations | PR.PS-01Configuration management practices are established and applied |
| Vulnerability scanning and patching | CC7.1Detection and monitoring procedures identify vulnerabilities | ID.RARisk assessment (vulnerability identification, ID.RA-01)PR.PS-02Software is maintained, replaced and removed commensurate with risk |
| Penetration testing and independent assessment | CC4.1Selects, develops and performs ongoing and/or separate evaluationsCC7.1Detection and monitoring procedures | ID.IMImprovement (incl. ID.IM-02, improvements from tests and exercises) |
| Logging, log review and monitoring | CC7.2Monitors system components for anomalies indicative of malicious acts, natural disasters and errors | DE.CMContinuous monitoringPR.PS-04Log records are generated and made available for continuous monitoring |
| Intrusion detection and integrity monitoring | CC7.2Monitors system components for anomaliesCC6.8Prevents or detects unauthorized or malicious software | DE.CMContinuous monitoringDE.AEAdverse event analysis |
| Malware protection | CC6.8Implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software | PR.PS-05Installation and execution of unauthorized software are preventedDE.CMContinuous monitoring |
| Incident response and breach notification | CC7.3Evaluates security events to determine whether they are incidentsCC7.4Responds to identified security incidentsCC7.5Identifies, develops and implements activities to recover from incidents | RS.MAIncident managementRS.ANIncident analysisRS.COIncident response reporting and communicationRS.MIIncident mitigationDE.AEAdverse event analysis |
| Change management | CC8.1Authorizes, designs, develops, configures, documents, tests, approves and implements changes | PR.PS-01Configuration management practices are established and applied |
| Secure software development | CC8.1Changes are developed, tested and approved | PR.PS-06Secure software development practices are integrated and their performance monitored |
| Third-party and vendor risk management | CC9.2Assesses and manages risks associated with vendors and business partners | GV.SCCybersecurity supply chain risk management |
| Business continuity and disaster recovery | CC9.1Identifies, selects and develops risk mitigation activities for business disruptionsA1.2Environmental protections, software, data backup processes and recovery infrastructureA1.3Tests recovery plan procedures | PR.IR-03Mechanisms are implemented to achieve resilience requirementsRC.RPIncident recovery plan execution |
| Backup and redundancy | A1.2Data backup processes and recovery infrastructure | PR.DS-11Backups of data are created, protected, maintained and tested |
| Capacity and availability management | A1.1Maintains, monitors and evaluates current processing capacity | PR.IR-04Adequate resource capacity to ensure availability is maintained |
| Security awareness and training | CC1.4Demonstrates commitment to attract, develop and retain competent individualsCC2.2Internally communicates information necessary to support internal control | PR.ATAwareness and training |
| Personnel screening, terms and sanctions | CC1.4Hiring and competence practicesCC6.3Removes access on termination | GV.RR-04Cybersecurity is included in human resources practices |
| Physical access and facility security | CC6.4Restricts physical access to facilities and protected information assets | PR.AA-06Physical access to assets is managed, monitored and enforced commensurate with risk |
| Data retention, media handling and secure disposal | CC6.5Discontinues logical and physical protections over assets only after the ability to read or recover data is diminishedC1.2Disposes of confidential information | ID.AM-08Systems, hardware, software, services and data are managed throughout their life cycles |
| Ongoing control monitoring and internal audit | CC4.1Selects, develops and performs ongoing and/or separate evaluationsCC4.2Evaluates and communicates internal control deficiencies | ID.IMImprovementGV.OVOversight |
Open a control objective for the evidence checklist.NIST CSF 2.0 to SOC 2 →
Scope: Security (CC series), Availability (A1) and Confidentiality (C1). Processing Integrity and Privacy are not covered in this dataset version. Mapped at category level (e.g. PR.AA) or subcategory where one is clearly the match (e.g. PR.AA-05). A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.