Fintech & regulatory

Compliance

How the current policy set maps to common compliance frameworks. Coverage is advisory: it is measured against the controls mapped in opserapol, not the full framework, and is not an audit artifact.

PCI DSS4.0100%

Payment Card Industry Data Security Standard

14 of 14 mapped controls covered

SOC 22017 TSC100%

AICPA Trust Services Criteria (Security)

6 of 6 mapped controls covered

CIS Kubernetes Benchmarkv1.8100%

Section 5 — policies enforceable at admission

16 of 16 mapped controls covered

NIST SP 800-53rev. 5100%

Security and privacy controls

13 of 13 mapped controls covered

ISO/IEC 270012022100%

Annex A controls

7 of 7 mapped controls covered

DORAEU 2022/2554100%

Digital Operational Resilience Act (EU financial entities)

5 of 5 mapped controls covered

PCI DSS 4.0pci-dss-4

14/14 (100%)

Control	Title	Mapped policies
1.2.5	All services, protocols and ports allowed are identified, approved and have a defined business need	Deployments with externally exposed endpoints Secure Shell (ssh) Port Exposed
1.3.1	Inbound traffic to the CDE is restricted to that which is necessary	Deployments should have at least one ingress Network Policy Docker CIS 5.7: Ensure privileged ports are not mapped within containers
2.2.1	Configuration standards are developed, implemented and maintained for system components	30-Day Scan Age 90-Day Image Age ADD Command used instead of COPY Alpine Linux Package Manager (apk) in Image Container using read-write root filesystem Container with privilege escalation allowed Curl in Image Deployments should have at least one ingress Network Policy Deployments with externally exposed endpoints Docker CIS 4.1: Ensure That a User for the Container Has Been Created Docker CIS 4.4: Ensure images are scanned and rebuilt to include security patches Docker CIS 4.7: Alert on Update Instruction Docker CIS 5.1 Ensure that, if applicable, an AppArmor Profile is enabled Docker CIS 5.15: Ensure that the host's process namespace is not shared Docker CIS 5.16: Ensure that the host's IPC namespace is not shared Docker CIS 5.19: Ensure mount propagation mode is not enabled Docker CIS 5.21: Ensure the default seccomp profile is not disabled Docker CIS 5.7: Ensure privileged ports are not mapped within containers Docker CIS 5.9 and 5.20: Ensure that the host's network namespace is not shared Emergency Deployment Annotation Environment Variable Contains Secret Insecure specified in CMD Iptables or nftables Executed in Privileged Container Kubernetes Dashboard Deployed Login Binaries Mount Container Runtime Socket Mounting Sensitive Host Directories No CPU request or memory limit specified Pod Service Account Token Automatically Mounted Privileged Container Process with UID 0 Red Hat Package Manager Execution Red Hat Package Manager in Image Required Annotation: Email Required Annotation: Owner/Team Required Image Label Required Label: Owner/Team Secret Mounted as Environment Variable Secure Shell (ssh) Port Exposed Secure Shell (ssh) Port Exposed in Image Secure Shell Server (sshd) Execution Ubuntu Package Manager in Image Wget in Image
2.2.4	Only necessary services, protocols, daemons and functions are enabled	Alpine Linux Package Manager Execution Compiler Tool Execution iptables Execution Iptables or nftables Executed in Privileged Container Mount Container Runtime Socket Mounting Sensitive Host Directories Netcat Execution Detected Network Management Execution nmap Execution Remote File Copy Binary Execution Secure Shell (ssh) Port Exposed Secure Shell Server (sshd) Execution Ubuntu Package Manager Execution
2.2.6	System security parameters are configured to prevent misuse	Container using read-write root filesystem Container with privilege escalation allowed Fixable CVSS >= 6 and Privileged Iptables or nftables Executed in Privileged Container Privileged Container Privileged Containers with Important and Critical Fixable CVEs
5.2.1	Anti-malware solutions are deployed on all system components	Cryptocurrency Mining Process Execution
5.3.2	Anti-malware mechanisms perform periodic and active/real-time scans	OpenShift: Central Admin Secret Accessed OpenShift: Kubeadmin Secret Accessed OpenShift: Kubernetes Secret Accessed by an Impersonated User Unauthorized Network Flow Unauthorized Process Execution
6.3.1	Security vulnerabilities are identified and managed	Apache Struts: CVE-2017-5638 Fixable CVSS >= 6 and Privileged Fixable CVSS >= 7 Fixable Severity at least Important Images with no scans Log4Shell: log4j Remote Code Execution vulnerability Privileged Containers with Important and Critical Fixable CVEs Rapid Reset: Denial of Service Vulnerability in HTTP/2 Protocol Spring4Shell (Spring Framework Remote Code Execution) and Spring Cloud Function vulnerabilities
6.3.2	An inventory of bespoke and custom software is maintained for vulnerability management	Alpine Linux Package Manager (apk) in Image Curl in Image Red Hat Package Manager in Image Ubuntu Package Manager in Image Wget in Image
6.3.3	Applicable security patches are installed within an appropriate timeframe	30-Day Scan Age 90-Day Image Age Docker CIS 4.4: Ensure images are scanned and rebuilt to include security patches Fixable CVSS >= 6 and Privileged Fixable CVSS >= 7 Fixable Severity at least Important Privileged Containers with Important and Critical Fixable CVEs
6.4.3	Software integrity is verified before deployment (supply chain)	30-Day Scan Age 90-Day Image Age Images with no scans Latest tag Red Hat images must be signed by a Red Hat release key Required Annotation: Email Required Annotation: Owner/Team Required Label: Owner/Team Require Signed Images
7.2.1	An access control model is defined providing least privileges	CAP_SYS_ADMIN capability added Container using read-write root filesystem Container with privilege escalation allowed Deployments should have at least one ingress Network Policy Fixable CVSS >= 6 and Privileged Linux Group Add Execution Linux User Add Execution Pod Service Account Token Automatically Mounted Privileged Container Privileged Containers with Important and Critical Fixable CVEs Unauthorized Network Flow
10.2.1	Audit logs capture all access and actions on system components	Kubernetes Actions: Exec into Pod Kubernetes Actions: Port Forward to Pod OpenShift: Central Admin Secret Accessed OpenShift: Kubeadmin Secret Accessed OpenShift: Kubernetes Secret Accessed by an Impersonated User
11.3.1	Internal vulnerability scans are performed regularly	30-Day Scan Age Images with no scans

SOC 2 2017 TSCsoc2

6/6 (100%)

Control	Title	Mapped policies
CC6.1	Logical access security software and architectures restrict access	CAP_SYS_ADMIN capability added Container using read-write root filesystem Container with privilege escalation allowed Deployments should have at least one ingress Network Policy Docker CIS 5.9 and 5.20: Ensure that the host's network namespace is not shared Fixable CVSS >= 6 and Privileged Iptables or nftables Executed in Privileged Container Linux Group Add Execution Linux User Add Execution Pod Service Account Token Automatically Mounted Privileged Container Privileged Containers with Important and Critical Fixable CVEs Unauthorized Network Flow
CC6.6	Boundary protection systems guard against threats from outside system boundaries	Deployments should have at least one ingress Network Policy Docker CIS 5.7: Ensure privileged ports are not mapped within containers Secure Shell (ssh) Port Exposed
CC6.8	Controls prevent or detect unauthorized or malicious software	30-Day Scan Age 90-Day Image Age Alpine Linux Package Manager Execution Compiler Tool Execution Cryptocurrency Mining Process Execution Images with no scans Latest tag Red Hat images must be signed by a Red Hat release key Required Annotation: Email Required Annotation: Owner/Team Required Label: Owner/Team Ubuntu Package Manager Execution Require Signed Images
CC7.1	Vulnerabilities are identified, monitored and evaluated	30-Day Scan Age Apache Struts: CVE-2017-5638 Fixable CVSS >= 6 and Privileged Fixable CVSS >= 7 Fixable Severity at least Important Images with no scans Log4Shell: log4j Remote Code Execution vulnerability Privileged Containers with Important and Critical Fixable CVEs Rapid Reset: Denial of Service Vulnerability in HTTP/2 Protocol Spring4Shell (Spring Framework Remote Code Execution) and Spring Cloud Function vulnerabilities
CC7.2	Anomalies indicative of malicious acts are monitored and analyzed	Kubernetes Actions: Exec into Pod Kubernetes Actions: Port Forward to Pod OpenShift: Central Admin Secret Accessed OpenShift: Kubeadmin Secret Accessed OpenShift: Kubernetes Secret Accessed by an Impersonated User Unauthorized Network Flow Unauthorized Process Execution
CC8.1	Changes to infrastructure and software are authorized, tested and approved	90-Day Image Age ADD Command used instead of COPY Deployments with externally exposed endpoints Drop All Capabilities Improper Usage of Orchestrator Secrets Volume Latest tag No CPU request or memory limit specified Process with UID 0 Required Annotation: Email Required Annotation: Owner/Team Required Image Label Required Label: Owner/Team

CIS Kubernetes Benchmark v1.8cis-k8s

16/16 (100%)

Control	Title	Mapped policies
5.1.5	Ensure that default service accounts are not actively used	Pod Service Account Token Automatically Mounted
5.1.6	Ensure that Service Account Tokens are only mounted where necessary	Pod Service Account Token Automatically Mounted
5.2.1	Minimize the admission of privileged containers	Fixable CVSS >= 6 and Privileged Iptables or nftables Executed in Privileged Container Privileged Container Privileged Containers with Important and Critical Fixable CVEs
5.2.2	Minimize the admission of containers wishing to share the host process ID namespace	Docker CIS 5.15: Ensure that the host's process namespace is not shared
5.2.3	Minimize the admission of containers wishing to share the host IPC namespace	Docker CIS 5.16: Ensure that the host's IPC namespace is not shared
5.2.4	Minimize the admission of containers wishing to share the host network namespace	Docker CIS 5.9 and 5.20: Ensure that the host's network namespace is not shared
5.2.5	Minimize the admission of containers with allowPrivilegeEscalation	Container with privilege escalation allowed
5.2.6	Minimize the admission of root containers	Docker CIS 4.1: Ensure That a User for the Container Has Been Created
5.2.8	Minimize the admission of containers with added capabilities	CAP_SYS_ADMIN capability added
5.2.9	Minimize the admission of containers with capabilities assigned	Drop All Capabilities
5.2.11	Minimize the admission of containers without a seccomp profile	Docker CIS 5.1 Ensure that, if applicable, an AppArmor Profile is enabled Docker CIS 5.21: Ensure the default seccomp profile is not disabled
5.3.2	Ensure that all Namespaces have Network Policies defined	Deployments should have at least one ingress Network Policy
5.4.1	Prefer using secrets as files over secrets as environment variables	Environment Variable Contains Secret Secret Mounted as Environment Variable
5.5.1	Configure Image Provenance using ImagePolicyWebhook admission controller	Red Hat images must be signed by a Red Hat release key Require Signed Images
5.7.2	Apply Security Context to Pods and Containers	Container using read-write root filesystem Docker CIS 5.21: Ensure the default seccomp profile is not disabled
5.7.4	The default namespace should not be used	Pod Service Account Token Automatically Mounted

NIST SP 800-53 rev. 5nist-800-53

13/13 (100%)

Control	Title	Mapped policies
AC-3	Access Enforcement	Pod Service Account Token Automatically Mounted
AC-6	Least Privilege	CAP_SYS_ADMIN capability added Container using read-write root filesystem Container with privilege escalation allowed Docker CIS 4.1: Ensure That a User for the Container Has Been Created Fixable CVSS >= 6 and Privileged Iptables or nftables Executed in Privileged Container Linux Group Add Execution Linux User Add Execution Pod Service Account Token Automatically Mounted Privileged Container Privileged Containers with Important and Critical Fixable CVEs
AU-2	Event Logging	Kubernetes Actions: Exec into Pod Kubernetes Actions: Port Forward to Pod OpenShift: Central Admin Secret Accessed OpenShift: Kubeadmin Secret Accessed OpenShift: Kubernetes Secret Accessed by an Impersonated User
CM-2	Baseline Configuration	30-Day Scan Age 90-Day Image Age ADD Command used instead of COPY Alpine Linux Package Manager (apk) in Image Container using read-write root filesystem Container with privilege escalation allowed Curl in Image Deployments should have at least one ingress Network Policy Deployments with externally exposed endpoints Docker CIS 4.1: Ensure That a User for the Container Has Been Created Docker CIS 4.4: Ensure images are scanned and rebuilt to include security patches Docker CIS 4.7: Alert on Update Instruction Docker CIS 5.1 Ensure that, if applicable, an AppArmor Profile is enabled Docker CIS 5.15: Ensure that the host's process namespace is not shared Docker CIS 5.16: Ensure that the host's IPC namespace is not shared Docker CIS 5.19: Ensure mount propagation mode is not enabled Docker CIS 5.21: Ensure the default seccomp profile is not disabled Docker CIS 5.7: Ensure privileged ports are not mapped within containers Docker CIS 5.9 and 5.20: Ensure that the host's network namespace is not shared Emergency Deployment Annotation Environment Variable Contains Secret Insecure specified in CMD Iptables or nftables Executed in Privileged Container Kubernetes Dashboard Deployed Login Binaries Mount Container Runtime Socket Mounting Sensitive Host Directories No CPU request or memory limit specified Pod Service Account Token Automatically Mounted Privileged Container Process with UID 0 Red Hat Package Manager Execution Red Hat Package Manager in Image Required Annotation: Email Required Annotation: Owner/Team Required Image Label Required Label: Owner/Team Secret Mounted as Environment Variable Secure Shell (ssh) Port Exposed Secure Shell (ssh) Port Exposed in Image Secure Shell Server (sshd) Execution Ubuntu Package Manager in Image Wget in Image
CM-6	Configuration Settings	Container using read-write root filesystem Docker CIS 5.1 Ensure that, if applicable, an AppArmor Profile is enabled Docker CIS 5.21: Ensure the default seccomp profile is not disabled
CM-7	Least Functionality	Alpine Linux Package Manager Execution Compiler Tool Execution iptables Execution Iptables or nftables Executed in Privileged Container Mount Container Runtime Socket Mounting Sensitive Host Directories Netcat Execution Detected Network Management Execution nmap Execution Remote File Copy Binary Execution Secure Shell (ssh) Port Exposed Secure Shell Server (sshd) Execution Ubuntu Package Manager Execution
RA-5	Vulnerability Monitoring and Scanning	30-Day Scan Age Apache Struts: CVE-2017-5638 Fixable CVSS >= 6 and Privileged Fixable CVSS >= 7 Fixable Severity at least Important Images with no scans Log4Shell: log4j Remote Code Execution vulnerability Privileged Containers with Important and Critical Fixable CVEs Rapid Reset: Denial of Service Vulnerability in HTTP/2 Protocol Spring4Shell (Spring Framework Remote Code Execution) and Spring Cloud Function vulnerabilities
SC-7	Boundary Protection	Deployments should have at least one ingress Network Policy Deployments with externally exposed endpoints Docker CIS 5.7: Ensure privileged ports are not mapped within containers
SI-2	Flaw Remediation	90-Day Image Age Docker CIS 4.4: Ensure images are scanned and rebuilt to include security patches Fixable CVSS >= 6 and Privileged Fixable CVSS >= 7 Fixable Severity at least Important Privileged Containers with Important and Critical Fixable CVEs
SI-3	Malicious Code Protection	Cryptocurrency Mining Process Execution
SI-4	System Monitoring	chkconfig Execution crontab Execution Linux Group Add Execution Linux User Add Execution OpenShift: Central Admin Secret Accessed OpenShift: Kubeadmin Secret Accessed OpenShift: Kubernetes Secret Accessed by an Impersonated User Password Binaries SetUID Processes Shadow File Modification Shell Management Shell Spawned by Java Application systemctl Execution systemd Execution Unauthorized Network Flow Unauthorized Process Execution
SR-4	Provenance (Supply Chain)	30-Day Scan Age 90-Day Image Age Images with no scans Latest tag Red Hat images must be signed by a Red Hat release key Required Annotation: Email Required Annotation: Owner/Team Required Label: Owner/Team Require Signed Images
SR-11	Component Authenticity	Red Hat images must be signed by a Red Hat release key Require Signed Images

ISO/IEC 27001 2022iso-27001

7/7 (100%)

Control	Title	Mapped policies
A.8.2	Privileged access rights	CAP_SYS_ADMIN capability added Container using read-write root filesystem Container with privilege escalation allowed Docker CIS 4.1: Ensure That a User for the Container Has Been Created Fixable CVSS >= 6 and Privileged Iptables or nftables Executed in Privileged Container Linux Group Add Execution Linux User Add Execution Pod Service Account Token Automatically Mounted Privileged Container Privileged Containers with Important and Critical Fixable CVEs
A.8.7	Protection against malware	Cryptocurrency Mining Process Execution
A.8.8	Management of technical vulnerabilities	Apache Struts: CVE-2017-5638 Fixable CVSS >= 6 and Privileged Fixable CVSS >= 7 Fixable Severity at least Important Images with no scans Log4Shell: log4j Remote Code Execution vulnerability Privileged Containers with Important and Critical Fixable CVEs Rapid Reset: Denial of Service Vulnerability in HTTP/2 Protocol Spring4Shell (Spring Framework Remote Code Execution) and Spring Cloud Function vulnerabilities
A.8.9	Configuration management	30-Day Scan Age 90-Day Image Age ADD Command used instead of COPY Alpine Linux Package Manager (apk) in Image Container using read-write root filesystem Container with privilege escalation allowed Curl in Image Deployments should have at least one ingress Network Policy Deployments with externally exposed endpoints Docker CIS 4.1: Ensure That a User for the Container Has Been Created Docker CIS 4.4: Ensure images are scanned and rebuilt to include security patches Docker CIS 4.7: Alert on Update Instruction Docker CIS 5.1 Ensure that, if applicable, an AppArmor Profile is enabled Docker CIS 5.15: Ensure that the host's process namespace is not shared Docker CIS 5.16: Ensure that the host's IPC namespace is not shared Docker CIS 5.19: Ensure mount propagation mode is not enabled Docker CIS 5.21: Ensure the default seccomp profile is not disabled Docker CIS 5.7: Ensure privileged ports are not mapped within containers Docker CIS 5.9 and 5.20: Ensure that the host's network namespace is not shared Emergency Deployment Annotation Environment Variable Contains Secret Insecure specified in CMD Iptables or nftables Executed in Privileged Container Kubernetes Dashboard Deployed Login Binaries Mount Container Runtime Socket Mounting Sensitive Host Directories No CPU request or memory limit specified Pod Service Account Token Automatically Mounted Privileged Container Process with UID 0 Red Hat Package Manager Execution Red Hat Package Manager in Image Required Annotation: Email Required Annotation: Owner/Team Required Image Label Required Label: Owner/Team Secret Mounted as Environment Variable Secure Shell (ssh) Port Exposed Secure Shell (ssh) Port Exposed in Image Secure Shell Server (sshd) Execution Ubuntu Package Manager in Image Wget in Image
A.8.16	Monitoring activities	Kubernetes Actions: Exec into Pod Kubernetes Actions: Port Forward to Pod OpenShift: Central Admin Secret Accessed OpenShift: Kubeadmin Secret Accessed OpenShift: Kubernetes Secret Accessed by an Impersonated User Unauthorized Network Flow Unauthorized Process Execution
A.8.20	Networks security	Deployments should have at least one ingress Network Policy Docker CIS 5.7: Ensure privileged ports are not mapped within containers iptables Execution Iptables or nftables Executed in Privileged Container Netcat Execution Detected Network Management Execution nmap Execution Remote File Copy Binary Execution Secure Shell (ssh) Port Exposed Secure Shell Server (sshd) Execution
A.8.25	Secure development life cycle	30-Day Scan Age 90-Day Image Age ADD Command used instead of COPY Deployments with externally exposed endpoints Docker CIS 4.7: Alert on Update Instruction Drop All Capabilities Images with no scans Improper Usage of Orchestrator Secrets Volume Insecure specified in CMD Latest tag No CPU request or memory limit specified Process with UID 0 Red Hat images must be signed by a Red Hat release key Required Annotation: Email Required Annotation: Owner/Team Required Image Label Required Label: Owner/Team Secure Shell (ssh) Port Exposed in Image Require Signed Images

DORA EU 2022/2554dora

5/5 (100%)

Control	Title	Mapped policies
Art. 9.2	Protection and prevention — ICT security policies and tools	30-Day Scan Age 90-Day Image Age ADD Command used instead of COPY Alpine Linux Package Manager (apk) in Image CAP_SYS_ADMIN capability added Container using read-write root filesystem Container with privilege escalation allowed Curl in Image Deployments should have at least one ingress Network Policy Deployments with externally exposed endpoints Docker CIS 4.1: Ensure That a User for the Container Has Been Created Docker CIS 4.4: Ensure images are scanned and rebuilt to include security patches Docker CIS 4.7: Alert on Update Instruction Docker CIS 5.1 Ensure that, if applicable, an AppArmor Profile is enabled Docker CIS 5.15: Ensure that the host's process namespace is not shared Docker CIS 5.16: Ensure that the host's IPC namespace is not shared Docker CIS 5.19: Ensure mount propagation mode is not enabled Docker CIS 5.21: Ensure the default seccomp profile is not disabled Docker CIS 5.7: Ensure privileged ports are not mapped within containers Docker CIS 5.9 and 5.20: Ensure that the host's network namespace is not shared Emergency Deployment Annotation Environment Variable Contains Secret Fixable CVSS >= 6 and Privileged Insecure specified in CMD Iptables or nftables Executed in Privileged Container Kubernetes Dashboard Deployed Linux Group Add Execution Linux User Add Execution Login Binaries Mount Container Runtime Socket Mounting Sensitive Host Directories No CPU request or memory limit specified Pod Service Account Token Automatically Mounted Privileged Container Privileged Containers with Important and Critical Fixable CVEs Process with UID 0 Red Hat Package Manager Execution Red Hat Package Manager in Image Required Annotation: Email Required Annotation: Owner/Team Required Image Label Required Label: Owner/Team Secret Mounted as Environment Variable Secure Shell (ssh) Port Exposed Secure Shell (ssh) Port Exposed in Image Secure Shell Server (sshd) Execution Ubuntu Package Manager in Image Wget in Image
Art. 9.4(b)	Network and infrastructure segmentation	Deployments should have at least one ingress Network Policy Docker CIS 5.7: Ensure privileged ports are not mapped within containers iptables Execution Iptables or nftables Executed in Privileged Container Netcat Execution Detected Network Management Execution nmap Execution Remote File Copy Binary Execution Secure Shell Server (sshd) Execution
Art. 9.4(c)	Patching and updates of ICT systems	90-Day Image Age Apache Struts: CVE-2017-5638 Docker CIS 4.4: Ensure images are scanned and rebuilt to include security patches Fixable CVSS >= 6 and Privileged Fixable CVSS >= 7 Fixable Severity at least Important Images with no scans Log4Shell: log4j Remote Code Execution vulnerability Privileged Containers with Important and Critical Fixable CVEs Rapid Reset: Denial of Service Vulnerability in HTTP/2 Protocol Spring4Shell (Spring Framework Remote Code Execution) and Spring Cloud Function vulnerabilities
Art. 10.1	Detection of anomalous activities and ICT incidents	Cryptocurrency Mining Process Execution Kubernetes Actions: Exec into Pod Kubernetes Actions: Port Forward to Pod OpenShift: Central Admin Secret Accessed OpenShift: Kubeadmin Secret Accessed OpenShift: Kubernetes Secret Accessed by an Impersonated User Unauthorized Network Flow Unauthorized Process Execution
Art. 28.1	ICT third-party risk — supply chain integrity	30-Day Scan Age 90-Day Image Age Images with no scans Latest tag Red Hat images must be signed by a Red Hat release key Required Annotation: Email Required Annotation: Owner/Team Required Label: Owner/Team Require Signed Images