Fintech & regulatory

Compliance

How the current policy set maps to common compliance frameworks. Coverage is advisory: it is measured against the controls mapped in opserapol, not the full framework, and is not an audit artifact.

PCI DSS4.0100%

Payment Card Industry Data Security Standard

14 of 14 mapped controls covered
SOC 22017 TSC100%

AICPA Trust Services Criteria (Security)

6 of 6 mapped controls covered
CIS Kubernetes Benchmarkv1.8100%

Section 5 — policies enforceable at admission

16 of 16 mapped controls covered
NIST SP 800-53rev. 5100%

Security and privacy controls

13 of 13 mapped controls covered
ISO/IEC 270012022100%

Annex A controls

7 of 7 mapped controls covered
DORAEU 2022/2554100%

Digital Operational Resilience Act (EU financial entities)

5 of 5 mapped controls covered
SOC 2 2017 TSCsoc2
6/6 (100%)
ControlTitleMapped policies
CC6.1Logical access security software and architectures restrict access
CAP_SYS_ADMIN capability addedContainer using read-write root filesystemContainer with privilege escalation allowedDeployments should have at least one ingress Network PolicyDocker CIS 5.9 and 5.20: Ensure that the host's network namespace is not sharedFixable CVSS >= 6 and PrivilegedIptables or nftables Executed in Privileged ContainerLinux Group Add ExecutionLinux User Add ExecutionPod Service Account Token Automatically MountedPrivileged ContainerPrivileged Containers with Important and Critical Fixable CVEsUnauthorized Network Flow
CC6.6Boundary protection systems guard against threats from outside system boundaries
Deployments should have at least one ingress Network PolicyDocker CIS 5.7: Ensure privileged ports are not mapped within containersSecure Shell (ssh) Port Exposed
CC6.8Controls prevent or detect unauthorized or malicious software
30-Day Scan Age90-Day Image AgeAlpine Linux Package Manager ExecutionCompiler Tool ExecutionCryptocurrency Mining Process ExecutionImages with no scansLatest tagRed Hat images must be signed by a Red Hat release keyRequired Annotation: EmailRequired Annotation: Owner/TeamRequired Label: Owner/TeamUbuntu Package Manager ExecutionRequire Signed Images
CC7.1Vulnerabilities are identified, monitored and evaluated
30-Day Scan AgeApache Struts: CVE-2017-5638Fixable CVSS >= 6 and PrivilegedFixable CVSS >= 7Fixable Severity at least ImportantImages with no scansLog4Shell: log4j Remote Code Execution vulnerabilityPrivileged Containers with Important and Critical Fixable CVEsRapid Reset: Denial of Service Vulnerability in HTTP/2 ProtocolSpring4Shell (Spring Framework Remote Code Execution) and Spring Cloud Function vulnerabilities
CC7.2Anomalies indicative of malicious acts are monitored and analyzed
Kubernetes Actions: Exec into PodKubernetes Actions: Port Forward to PodOpenShift: Central Admin Secret AccessedOpenShift: Kubeadmin Secret AccessedOpenShift: Kubernetes Secret Accessed by an Impersonated UserUnauthorized Network FlowUnauthorized Process Execution
CC8.1Changes to infrastructure and software are authorized, tested and approved
90-Day Image AgeADD Command used instead of COPYDeployments with externally exposed endpointsDrop All CapabilitiesImproper Usage of Orchestrator Secrets VolumeLatest tagNo CPU request or memory limit specifiedProcess with UID 0Required Annotation: EmailRequired Annotation: Owner/TeamRequired Image LabelRequired Label: Owner/Team