Fintech & regulatory

Compliance

How the current policy set maps to common compliance frameworks. Coverage is advisory: it is measured against the controls mapped in opserapol, not the full framework, and is not an audit artifact.

PCI DSS4.0100%

Payment Card Industry Data Security Standard

14 of 14 mapped controls covered

SOC 22017 TSC100%

AICPA Trust Services Criteria (Security)

6 of 6 mapped controls covered

CIS Kubernetes Benchmarkv1.8100%

Section 5 — policies enforceable at admission

16 of 16 mapped controls covered

NIST SP 800-53rev. 5100%

Security and privacy controls

13 of 13 mapped controls covered

ISO/IEC 270012022100%

Annex A controls

7 of 7 mapped controls covered

DORAEU 2022/2554100%

Digital Operational Resilience Act (EU financial entities)

5 of 5 mapped controls covered

NIST SP 800-53 rev. 5nist-800-53

13/13 (100%)

Control	Title	Mapped policies
AC-3	Access Enforcement	Pod Service Account Token Automatically Mounted
AC-6	Least Privilege	CAP_SYS_ADMIN capability added Container using read-write root filesystem Container with privilege escalation allowed Docker CIS 4.1: Ensure That a User for the Container Has Been Created Fixable CVSS >= 6 and Privileged Iptables or nftables Executed in Privileged Container Linux Group Add Execution Linux User Add Execution Pod Service Account Token Automatically Mounted Privileged Container Privileged Containers with Important and Critical Fixable CVEs
AU-2	Event Logging	Kubernetes Actions: Exec into Pod Kubernetes Actions: Port Forward to Pod OpenShift: Central Admin Secret Accessed OpenShift: Kubeadmin Secret Accessed OpenShift: Kubernetes Secret Accessed by an Impersonated User
CM-2	Baseline Configuration	30-Day Scan Age 90-Day Image Age ADD Command used instead of COPY Alpine Linux Package Manager (apk) in Image Container using read-write root filesystem Container with privilege escalation allowed Curl in Image Deployments should have at least one ingress Network Policy Deployments with externally exposed endpoints Docker CIS 4.1: Ensure That a User for the Container Has Been Created Docker CIS 4.4: Ensure images are scanned and rebuilt to include security patches Docker CIS 4.7: Alert on Update Instruction Docker CIS 5.1 Ensure that, if applicable, an AppArmor Profile is enabled Docker CIS 5.15: Ensure that the host's process namespace is not shared Docker CIS 5.16: Ensure that the host's IPC namespace is not shared Docker CIS 5.19: Ensure mount propagation mode is not enabled Docker CIS 5.21: Ensure the default seccomp profile is not disabled Docker CIS 5.7: Ensure privileged ports are not mapped within containers Docker CIS 5.9 and 5.20: Ensure that the host's network namespace is not shared Emergency Deployment Annotation Environment Variable Contains Secret Insecure specified in CMD Iptables or nftables Executed in Privileged Container Kubernetes Dashboard Deployed Login Binaries Mount Container Runtime Socket Mounting Sensitive Host Directories No CPU request or memory limit specified Pod Service Account Token Automatically Mounted Privileged Container Process with UID 0 Red Hat Package Manager Execution Red Hat Package Manager in Image Required Annotation: Email Required Annotation: Owner/Team Required Image Label Required Label: Owner/Team Secret Mounted as Environment Variable Secure Shell (ssh) Port Exposed Secure Shell (ssh) Port Exposed in Image Secure Shell Server (sshd) Execution Ubuntu Package Manager in Image Wget in Image
CM-6	Configuration Settings	Container using read-write root filesystem Docker CIS 5.1 Ensure that, if applicable, an AppArmor Profile is enabled Docker CIS 5.21: Ensure the default seccomp profile is not disabled
CM-7	Least Functionality	Alpine Linux Package Manager Execution Compiler Tool Execution iptables Execution Iptables or nftables Executed in Privileged Container Mount Container Runtime Socket Mounting Sensitive Host Directories Netcat Execution Detected Network Management Execution nmap Execution Remote File Copy Binary Execution Secure Shell (ssh) Port Exposed Secure Shell Server (sshd) Execution Ubuntu Package Manager Execution
RA-5	Vulnerability Monitoring and Scanning	30-Day Scan Age Apache Struts: CVE-2017-5638 Fixable CVSS >= 6 and Privileged Fixable CVSS >= 7 Fixable Severity at least Important Images with no scans Log4Shell: log4j Remote Code Execution vulnerability Privileged Containers with Important and Critical Fixable CVEs Rapid Reset: Denial of Service Vulnerability in HTTP/2 Protocol Spring4Shell (Spring Framework Remote Code Execution) and Spring Cloud Function vulnerabilities
SC-7	Boundary Protection	Deployments should have at least one ingress Network Policy Deployments with externally exposed endpoints Docker CIS 5.7: Ensure privileged ports are not mapped within containers
SI-2	Flaw Remediation	90-Day Image Age Docker CIS 4.4: Ensure images are scanned and rebuilt to include security patches Fixable CVSS >= 6 and Privileged Fixable CVSS >= 7 Fixable Severity at least Important Privileged Containers with Important and Critical Fixable CVEs
SI-3	Malicious Code Protection	Cryptocurrency Mining Process Execution
SI-4	System Monitoring	chkconfig Execution crontab Execution Linux Group Add Execution Linux User Add Execution OpenShift: Central Admin Secret Accessed OpenShift: Kubeadmin Secret Accessed OpenShift: Kubernetes Secret Accessed by an Impersonated User Password Binaries SetUID Processes Shadow File Modification Shell Management Shell Spawned by Java Application systemctl Execution systemd Execution Unauthorized Network Flow Unauthorized Process Execution
SR-4	Provenance (Supply Chain)	30-Day Scan Age 90-Day Image Age Images with no scans Latest tag Red Hat images must be signed by a Red Hat release key Required Annotation: Email Required Annotation: Owner/Team Required Label: Owner/Team Require Signed Images
SR-11	Component Authenticity	Red Hat images must be signed by a Red Hat release key Require Signed Images