Fintech & regulatory

Compliance

How the current policy set maps to common compliance frameworks. Coverage is advisory: it is measured against the controls mapped in opserapol, not the full framework, and is not an audit artifact.

PCI DSS4.0100%

Payment Card Industry Data Security Standard

14 of 14 mapped controls covered

SOC 22017 TSC100%

AICPA Trust Services Criteria (Security)

6 of 6 mapped controls covered

CIS Kubernetes Benchmarkv1.8100%

Section 5 — policies enforceable at admission

16 of 16 mapped controls covered

NIST SP 800-53rev. 5100%

Security and privacy controls

13 of 13 mapped controls covered

ISO/IEC 270012022100%

Annex A controls

7 of 7 mapped controls covered

DORAEU 2022/2554100%

Digital Operational Resilience Act (EU financial entities)

5 of 5 mapped controls covered

CIS Kubernetes Benchmark v1.8cis-k8s

16/16 (100%)

Control	Title	Mapped policies
5.1.5	Ensure that default service accounts are not actively used	Pod Service Account Token Automatically Mounted
5.1.6	Ensure that Service Account Tokens are only mounted where necessary	Pod Service Account Token Automatically Mounted
5.2.1	Minimize the admission of privileged containers	Fixable CVSS >= 6 and Privileged Iptables or nftables Executed in Privileged Container Privileged Container Privileged Containers with Important and Critical Fixable CVEs
5.2.2	Minimize the admission of containers wishing to share the host process ID namespace	Docker CIS 5.15: Ensure that the host's process namespace is not shared
5.2.3	Minimize the admission of containers wishing to share the host IPC namespace	Docker CIS 5.16: Ensure that the host's IPC namespace is not shared
5.2.4	Minimize the admission of containers wishing to share the host network namespace	Docker CIS 5.9 and 5.20: Ensure that the host's network namespace is not shared
5.2.5	Minimize the admission of containers with allowPrivilegeEscalation	Container with privilege escalation allowed
5.2.6	Minimize the admission of root containers	Docker CIS 4.1: Ensure That a User for the Container Has Been Created
5.2.8	Minimize the admission of containers with added capabilities	CAP_SYS_ADMIN capability added
5.2.9	Minimize the admission of containers with capabilities assigned	Drop All Capabilities
5.2.11	Minimize the admission of containers without a seccomp profile	Docker CIS 5.1 Ensure that, if applicable, an AppArmor Profile is enabled Docker CIS 5.21: Ensure the default seccomp profile is not disabled
5.3.2	Ensure that all Namespaces have Network Policies defined	Deployments should have at least one ingress Network Policy
5.4.1	Prefer using secrets as files over secrets as environment variables	Environment Variable Contains Secret Secret Mounted as Environment Variable
5.5.1	Configure Image Provenance using ImagePolicyWebhook admission controller	Red Hat images must be signed by a Red Hat release key Require Signed Images
5.7.2	Apply Security Context to Pods and Containers	Container using read-write root filesystem Docker CIS 5.21: Ensure the default seccomp profile is not disabled
5.7.4	The default namespace should not be used	Pod Service Account Token Automatically Mounted