Fintech & regulatory

Compliance

How the current policy set maps to common compliance frameworks. Coverage is advisory: it is measured against the controls mapped in opserapol, not the full framework, and is not an audit artifact.

PCI DSS4.0100%

Payment Card Industry Data Security Standard

14 of 14 mapped controls covered

SOC 22017 TSC100%

AICPA Trust Services Criteria (Security)

6 of 6 mapped controls covered

CIS Kubernetes Benchmarkv1.8100%

Section 5 — policies enforceable at admission

16 of 16 mapped controls covered

NIST SP 800-53rev. 5100%

Security and privacy controls

13 of 13 mapped controls covered

ISO/IEC 270012022100%

Annex A controls

7 of 7 mapped controls covered

DORAEU 2022/2554100%

Digital Operational Resilience Act (EU financial entities)

5 of 5 mapped controls covered

ISO/IEC 27001 2022iso-27001

7/7 (100%)

Control	Title	Mapped policies
A.8.2	Privileged access rights	CAP_SYS_ADMIN capability added Container using read-write root filesystem Container with privilege escalation allowed Docker CIS 4.1: Ensure That a User for the Container Has Been Created Fixable CVSS >= 6 and Privileged Iptables or nftables Executed in Privileged Container Linux Group Add Execution Linux User Add Execution Pod Service Account Token Automatically Mounted Privileged Container Privileged Containers with Important and Critical Fixable CVEs
A.8.7	Protection against malware	Cryptocurrency Mining Process Execution
A.8.8	Management of technical vulnerabilities	Apache Struts: CVE-2017-5638 Fixable CVSS >= 6 and Privileged Fixable CVSS >= 7 Fixable Severity at least Important Images with no scans Log4Shell: log4j Remote Code Execution vulnerability Privileged Containers with Important and Critical Fixable CVEs Rapid Reset: Denial of Service Vulnerability in HTTP/2 Protocol Spring4Shell (Spring Framework Remote Code Execution) and Spring Cloud Function vulnerabilities
A.8.9	Configuration management	30-Day Scan Age 90-Day Image Age ADD Command used instead of COPY Alpine Linux Package Manager (apk) in Image Container using read-write root filesystem Container with privilege escalation allowed Curl in Image Deployments should have at least one ingress Network Policy Deployments with externally exposed endpoints Docker CIS 4.1: Ensure That a User for the Container Has Been Created Docker CIS 4.4: Ensure images are scanned and rebuilt to include security patches Docker CIS 4.7: Alert on Update Instruction Docker CIS 5.1 Ensure that, if applicable, an AppArmor Profile is enabled Docker CIS 5.15: Ensure that the host's process namespace is not shared Docker CIS 5.16: Ensure that the host's IPC namespace is not shared Docker CIS 5.19: Ensure mount propagation mode is not enabled Docker CIS 5.21: Ensure the default seccomp profile is not disabled Docker CIS 5.7: Ensure privileged ports are not mapped within containers Docker CIS 5.9 and 5.20: Ensure that the host's network namespace is not shared Emergency Deployment Annotation Environment Variable Contains Secret Insecure specified in CMD Iptables or nftables Executed in Privileged Container Kubernetes Dashboard Deployed Login Binaries Mount Container Runtime Socket Mounting Sensitive Host Directories No CPU request or memory limit specified Pod Service Account Token Automatically Mounted Privileged Container Process with UID 0 Red Hat Package Manager Execution Red Hat Package Manager in Image Required Annotation: Email Required Annotation: Owner/Team Required Image Label Required Label: Owner/Team Secret Mounted as Environment Variable Secure Shell (ssh) Port Exposed Secure Shell (ssh) Port Exposed in Image Secure Shell Server (sshd) Execution Ubuntu Package Manager in Image Wget in Image
A.8.16	Monitoring activities	Kubernetes Actions: Exec into Pod Kubernetes Actions: Port Forward to Pod OpenShift: Central Admin Secret Accessed OpenShift: Kubeadmin Secret Accessed OpenShift: Kubernetes Secret Accessed by an Impersonated User Unauthorized Network Flow Unauthorized Process Execution
A.8.20	Networks security	Deployments should have at least one ingress Network Policy Docker CIS 5.7: Ensure privileged ports are not mapped within containers iptables Execution Iptables or nftables Executed in Privileged Container Netcat Execution Detected Network Management Execution nmap Execution Remote File Copy Binary Execution Secure Shell (ssh) Port Exposed Secure Shell Server (sshd) Execution
A.8.25	Secure development life cycle	30-Day Scan Age 90-Day Image Age ADD Command used instead of COPY Deployments with externally exposed endpoints Docker CIS 4.7: Alert on Update Instruction Drop All Capabilities Images with no scans Improper Usage of Orchestrator Secrets Volume Insecure specified in CMD Latest tag No CPU request or memory limit specified Process with UID 0 Red Hat images must be signed by a Red Hat release key Required Annotation: Email Required Annotation: Owner/Team Required Image Label Required Label: Owner/Team Secure Shell (ssh) Port Exposed in Image Require Signed Images