Fintech & regulatory

Compliance

How the current policy set maps to common compliance frameworks. Coverage is advisory: it is measured against the controls mapped in opserapol, not the full framework, and is not an audit artifact.

PCI DSS4.0100%

Payment Card Industry Data Security Standard

14 of 14 mapped controls covered

SOC 22017 TSC100%

AICPA Trust Services Criteria (Security)

6 of 6 mapped controls covered

CIS Kubernetes Benchmarkv1.8100%

Section 5 — policies enforceable at admission

16 of 16 mapped controls covered

NIST SP 800-53rev. 5100%

Security and privacy controls

13 of 13 mapped controls covered

ISO/IEC 270012022100%

Annex A controls

7 of 7 mapped controls covered

DORAEU 2022/2554100%

Digital Operational Resilience Act (EU financial entities)

5 of 5 mapped controls covered

PCI DSS 4.0pci-dss-4

14/14 (100%)

Control	Title	Mapped policies
1.2.5	All services, protocols and ports allowed are identified, approved and have a defined business need	Deployments with externally exposed endpoints Secure Shell (ssh) Port Exposed
1.3.1	Inbound traffic to the CDE is restricted to that which is necessary	Deployments should have at least one ingress Network Policy Docker CIS 5.7: Ensure privileged ports are not mapped within containers
2.2.1	Configuration standards are developed, implemented and maintained for system components	30-Day Scan Age 90-Day Image Age ADD Command used instead of COPY Alpine Linux Package Manager (apk) in Image Container using read-write root filesystem Container with privilege escalation allowed Curl in Image Deployments should have at least one ingress Network Policy Deployments with externally exposed endpoints Docker CIS 4.1: Ensure That a User for the Container Has Been Created Docker CIS 4.4: Ensure images are scanned and rebuilt to include security patches Docker CIS 4.7: Alert on Update Instruction Docker CIS 5.1 Ensure that, if applicable, an AppArmor Profile is enabled Docker CIS 5.15: Ensure that the host's process namespace is not shared Docker CIS 5.16: Ensure that the host's IPC namespace is not shared Docker CIS 5.19: Ensure mount propagation mode is not enabled Docker CIS 5.21: Ensure the default seccomp profile is not disabled Docker CIS 5.7: Ensure privileged ports are not mapped within containers Docker CIS 5.9 and 5.20: Ensure that the host's network namespace is not shared Emergency Deployment Annotation Environment Variable Contains Secret Insecure specified in CMD Iptables or nftables Executed in Privileged Container Kubernetes Dashboard Deployed Login Binaries Mount Container Runtime Socket Mounting Sensitive Host Directories No CPU request or memory limit specified Pod Service Account Token Automatically Mounted Privileged Container Process with UID 0 Red Hat Package Manager Execution Red Hat Package Manager in Image Required Annotation: Email Required Annotation: Owner/Team Required Image Label Required Label: Owner/Team Secret Mounted as Environment Variable Secure Shell (ssh) Port Exposed Secure Shell (ssh) Port Exposed in Image Secure Shell Server (sshd) Execution Ubuntu Package Manager in Image Wget in Image
2.2.4	Only necessary services, protocols, daemons and functions are enabled	Alpine Linux Package Manager Execution Compiler Tool Execution iptables Execution Iptables or nftables Executed in Privileged Container Mount Container Runtime Socket Mounting Sensitive Host Directories Netcat Execution Detected Network Management Execution nmap Execution Remote File Copy Binary Execution Secure Shell (ssh) Port Exposed Secure Shell Server (sshd) Execution Ubuntu Package Manager Execution
2.2.6	System security parameters are configured to prevent misuse	Container using read-write root filesystem Container with privilege escalation allowed Fixable CVSS >= 6 and Privileged Iptables or nftables Executed in Privileged Container Privileged Container Privileged Containers with Important and Critical Fixable CVEs
5.2.1	Anti-malware solutions are deployed on all system components	Cryptocurrency Mining Process Execution
5.3.2	Anti-malware mechanisms perform periodic and active/real-time scans	OpenShift: Central Admin Secret Accessed OpenShift: Kubeadmin Secret Accessed OpenShift: Kubernetes Secret Accessed by an Impersonated User Unauthorized Network Flow Unauthorized Process Execution
6.3.1	Security vulnerabilities are identified and managed	Apache Struts: CVE-2017-5638 Fixable CVSS >= 6 and Privileged Fixable CVSS >= 7 Fixable Severity at least Important Images with no scans Log4Shell: log4j Remote Code Execution vulnerability Privileged Containers with Important and Critical Fixable CVEs Rapid Reset: Denial of Service Vulnerability in HTTP/2 Protocol Spring4Shell (Spring Framework Remote Code Execution) and Spring Cloud Function vulnerabilities
6.3.2	An inventory of bespoke and custom software is maintained for vulnerability management	Alpine Linux Package Manager (apk) in Image Curl in Image Red Hat Package Manager in Image Ubuntu Package Manager in Image Wget in Image
6.3.3	Applicable security patches are installed within an appropriate timeframe	30-Day Scan Age 90-Day Image Age Docker CIS 4.4: Ensure images are scanned and rebuilt to include security patches Fixable CVSS >= 6 and Privileged Fixable CVSS >= 7 Fixable Severity at least Important Privileged Containers with Important and Critical Fixable CVEs
6.4.3	Software integrity is verified before deployment (supply chain)	30-Day Scan Age 90-Day Image Age Images with no scans Latest tag Red Hat images must be signed by a Red Hat release key Required Annotation: Email Required Annotation: Owner/Team Required Label: Owner/Team Require Signed Images
7.2.1	An access control model is defined providing least privileges	CAP_SYS_ADMIN capability added Container using read-write root filesystem Container with privilege escalation allowed Deployments should have at least one ingress Network Policy Fixable CVSS >= 6 and Privileged Linux Group Add Execution Linux User Add Execution Pod Service Account Token Automatically Mounted Privileged Container Privileged Containers with Important and Critical Fixable CVEs Unauthorized Network Flow
10.2.1	Audit logs capture all access and actions on system components	Kubernetes Actions: Exec into Pod Kubernetes Actions: Port Forward to Pod OpenShift: Central Admin Secret Accessed OpenShift: Kubeadmin Secret Accessed OpenShift: Kubernetes Secret Accessed by an Impersonated User
11.3.1	Internal vulnerability scans are performed regularly	30-Day Scan Age Images with no scans