# Compliance Framework Quick Reference

## SOC 2 Type II — Trust Service Criteria
| Control | Description | Evidence Required |
|---------|-------------|-------------------|
| CC1.1 | Control environment | Org chart, policies, training records |
| CC2.1 | Communication | Security awareness program, incident comms |
| CC3.1 | Risk assessment | Risk register, annual assessment report |
| CC5.1 | Monitoring | Continuous monitoring dashboards, alert configs |
| CC6.1 | Logical access | IAM policies, access reviews, MFA enforcement |
| CC6.6 | System boundaries | Firewall configs, network segmentation |
| CC7.1 | System monitoring | SIEM configs, log retention policies |
| CC7.2 | Incident detection | IDS/IPS configs, alert thresholds |
| CC8.1 | Change management | Change tickets, approval workflows, rollback plans |

## PCI DSS v4.0 — Key Requirements
| Req | Area | Key Controls |
|-----|------|-------------|
| 1 | Network security | Firewall, DMZ, network segmentation |
| 2 | Secure defaults | No vendor defaults, hardening standards |
| 3 | Protect CHD | Encryption at rest, key management, masking |
| 4 | Encrypt transit | TLS 1.2+, no legacy protocols |
| 6 | Secure development | SDLC, code review, vuln management |
| 8 | Authentication | MFA, strong passwords, session timeout |
| 10 | Logging | Audit trails, log integrity, 1-year retention |
| 11 | Testing | Quarterly scans, annual pentests, IDS |
| 12 | Policies | Security policy, risk assessment, IR plan |

## NIST 800-53 Rev 5 — Control Families
AC (Access Control) · AT (Awareness) · AU (Audit) · CA (Assessment) · CM (Configuration) · CP (Contingency) · IA (Identification) · IR (Incident Response) · MA (Maintenance) · MP (Media Protection) · PE (Physical) · PL (Planning) · PM (Program Management) · PS (Personnel) · PT (Privacy) · RA (Risk Assessment) · SA (System Acquisition) · SC (System Communications) · SI (System Integrity) · SR (Supply Chain Risk)
