From time to time, Drata updates certain DCF controls to be more accurate. To learn more about how Drata creates and maintains the DCF library, check out this article.
On 1/18/2024, Drata updated 203 of our controls in our control library to be more accurate. You can always access Drata's latest control template in your account by using the steps outlined in this help article.
Code | Name | Framework | Associated Policies |
DCF-10 | System Access Control Policy | SOC 2,ISO 27001:13,HIPAA,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,Cyber Essentials,ISO 27018:19,ISO 27017:15,PCI 4.0 | System Access Control Policy |
DCF-101 | Data Retention Policy | SOC 2,ISO 27001:13,HIPAA,PCI 3.2.1,ISO 27001:22,NIST SP 800-53r5,CCM,FedRAMP,ISO 27017:15,ISO 27018:19,PCI 4.0 | Data Retention Policy,Public Cloud PII Protection Policy |
DCF-106 | Clean Desk and Clear Screen Policies and Procedures | ISO 27001:13,HIPAA,ISO 27001:22,PCI 4.0 | Acceptable Use Policy |
DCF-107 | Disposal of Sensitive Data on Paper | SOC 2,ISO 27001:13,HIPAA,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,ISO 27018:19,PCI 4.0 | Data Protection Policy,Public Cloud PII Protection Policy |
DCF-108 | Storage of Sensitive Data on Paper | SOC 2,ISO 27001:13,HIPAA,CCPA,CPRA,ISO 27001:22,CCM,PCI 4.0 | Data Protection Policy,Public Cloud PII Protection Policy |
DCF-11 | Periodic Access Control Review | SOC 2,ISO 27001:13,HIPAA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,Cyber Essentials,ISO 27017:15,PCI 4.0 | System Access Control Policy |
DCF-12 | System Security Configuration and Hardening Standards | SOC 2,ISO 27001:13,PCI 3.2.1,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,Cyber Essentials,ISO 27017:15,PCI 4.0 | Asset Management Policy |
DCF-13 | Information Security Policy | SOC 2,ISO 27001:13,HIPAA,PCI 3.2.1,GDPR,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,ISO 27018:19,ISO 27017:15,PCI 4.0 | Information Security Policy,ISMS Plan (2013 and 2022) |
DCF-150 | Data Loss Prevention (DLP) Mechanisms | SOC 2,ISO 27001:13,HIPAA,CCPA,CPRA,ISO 27001:22,CCM,NIST CSF,PCI 4.0 | Data Protection Policy |
DCF-154 | Annual Incident Response Test | SOC 2,ISO 27001:13,HIPAA,PCI 3.2.1,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,NIST CSF,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Incident Response Plan |
DCF-156 | Production Code Released by Appropriate Personnel | SOC 2,ISO 27001:13,ISO 27001:22,CCM,PCI 4.0 | Software Development Life Cycle Policy,Change Management Policy |
DCF-159 | Incident Response Plan | SOC 2,ISO 27001:13,HIPAA,PCI 3.2.1,GDPR,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,ISO 27018:19,ISO 27017:15,NIST AI RMF,PCI 4.0 | Incident Response Plan |
DCF-171 | Documented Operating Procedures | ISO 27001:13,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,NIST CSF,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Information Security Policy |
DCF-183 | Vulnerability Management Policy | SOC 2,ISO 27001:13,HIPAA,PCI 3.2.1,GDPR,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,Cyber Essentials,PCI 4.0 | Vulnerability Management Policy |
DCF-188 | Communication with Security and Privacy Organizations | ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,FedRAMP,PCI 4.0 | Vulnerability Management Policy |
DCF-20 | Asset Inventory | SOC 2,ISO 27001:13,HIPAA,PCI 3.2.1,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,Cyber Essentials,ISO 27017:15,NIST AI RMF,PCI 4.0 | Asset Management Policy |
DCF-201 | Network Security Controls Configuration Standards | PCI 3.2.1,Cyber Essentials,PCI 4.0 | Network Security Policy |
DCF-204 | Dataflow Diagram | PCI 3.2.1,CCPA,CPRA,CCM,NIST CSF,PCI 4.0 | Network Security Policy,PCI DSS Compliance Policy |
DCF-206 | Network Security Controls Between Trusted and Untrusted Networks | PCI 3.2.1,NIST SP 800-53r5,CCM,NIST SP 800-171r2,FedRAMP,Cyber Essentials,PCI 4.0 | Network Security Policy,PCI DSS Compliance Policy |
DCF-210 | Insecure Services, Protocols, and Ports Documentation and Control | PCI 3.2.1,NIST SP 800-53r5,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Network Security Policy |
DCF-212 | Network Security Controls Review | PCI 3.2.1,Cyber Essentials,PCI 4.0 | Network Security Policy |
DCF-215 | Secured Configuration Files | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy,Network Security Policy |
DCF-216 | Network Security Controls Restricting Wireless Network Traffic | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-218 | Inbound Traffic Restricted Between Untrusted and Trusted Networks | PCI 3.2.1,NIST SP 800-53r5,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Network Security Policy,PCI DSS Compliance Policy |
DCF-22 | Network Diagram | SOC 2,ISO 27001:13,HIPAA,CCPA,CPRA,ISO 27001:22,CCM,NIST CSF,NIST SP 800-171r2,ISO 27017:15,PCI 4.0 | Network Security Policy |
DCF-220 | Anti-Spoofing Measures | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-223 | Sensitive Data Not Directly Accessible From Untrusted Networks | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-225 | External Private IP Information Disclosure Restricted | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-229 | Vendor Default Accounts Disabled, Removed or Changed | PCI 3.2.1,CCM,NIST SP 800-171r2,Cyber Essentials,PCI 4.0 | Asset Management Policy |
DCF-231 | Changes in Encryption Keys for Wireless Environments | PCI 3.2.1,PCI 4.0 | Encryption Policy,PCI DSS Compliance Policy |
DCF-233 | Wireless Network Vendor Defaults Changed | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-239 | One Primary Function per System Component | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-240 | Only Necessary System Function Services Used | PCI 3.2.1,NIST SP 800-53r5,FedRAMP,PCI 4.0 | Asset Management Policy |
DCF-241 | Documentation and Risk Mitigation for Insecure Services | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-244 | System Security Parameters in Configuration Standards | PCI 3.2.1,NIST SP 800-53r5,NIST CSF,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Asset Management Policy |
DCF-249 | Encrypted Non-Console Administrative Access | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-253 | Data Secure Disposal | PCI 3.2.1,PCI 4.0,ISO 27001:22,HIPAA,SOC 2 | Data Retention Policy |
DCF-255 | Quarterly Cardholder Data Disposal Review | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-257 | Sensitive Authentication Data Storage | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-258 | Sensitive Authentication Data Secured | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-259 | Sensitive Authentication Data Deleted after Authorization Process | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-260 | Full Track Contents Not Retained | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-261 | Card Verification Code Not Retained | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-262 | PIN Not Retained | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-263 | PAN is Masked when Displayed | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-264 | PAN Unreadable Where Stored | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-265 | Separate Encrypted File System Access Management | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-267 | Sensitive Data on Removable Media Encrypted | PCI 3.2.1,PCI 4.0 | Asset Management Policy |
DCF-268 | Cryptographic Architecture Description (Service Providers Only) | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-269 | Restricted Cleartext Key Access | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-270 | Key-Encrypting Keys Secured | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-271 | Key Storage Locations Limited | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-272 | Guidance for Shared Key Management | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-273 | Strong Key Generation Policies and Procedures | PCI 3.2.1,CCM,PCI 4.0 | Encryption Policy,PCI DSS Compliance Policy |
DCF-276 | Key Changes for Retired Keys | PCI 3.2.1,CCM,PCI 4.0 | PCI DSS Compliance Policy |
DCF-278 | Key Retirement Policies and Procedures | PCI 3.2.1,CCM,PCI 4.0 | Encryption Policy,PCI DSS Compliance Policy |
DCF-28 | Security Events Tracked and Evaluated | SOC 2,ISO 27001:13,HIPAA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Incident Response Plan |
DCF-280 | Split Knowledge and Dual Control of Keys | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-281 | Prevention of Unauthorized Key Substitution | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-282 | Formal Acknowledgment of Key Custodial Responsibilities | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-284 | Only Trusted Keys or Certificates Accepted | PCI 3.2.1,NIST SP 800-53r5,FedRAMP,PCI 4.0 | PCI DSS Compliance Policy,Encryption Policy |
DCF-285 | Insecure Versions or Configurations Not Supported | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-288 | Strong Encryption for Wireless Network Transmission | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-289 | Sensitive Data Secured in Transmission via End-User Messaging Technologies | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy,Data Protection Policy |
DCF-291 | Anti-Virus Capability | PCI 3.2.1,CCPA,CPRA,NIST SP 800-53r5,NIST CSF,NIST SP 800-171r2,FedRAMP,Cyber Essentials,PCI 4.0 | Vulnerability Management Policy |
DCF-292 | Periodic Evaluation of Malware Threats | PCI 3.2.1,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,NIST CSF,NIST SP 800-171r2,FedRAMP,Cyber Essentials,PCI 4.0 | PCI DSS Compliance Policy |
DCF-293 | Anti-Malware Capabilities and Automatic Updates | PCI 3.2.1,CCPA,CPRA,Cyber Essentials,PCI 4.0 | Vulnerability Management Policy |
DCF-294 | Anti-Malware Tools Behavior | PCI 3.2.1,CCM,NIST CSF,Cyber Essentials,PCI 4.0 | Vulnerability Management Policy |
DCF-296 | Access to Anti-Virus Configuration | PCI 3.2.1,PCI 4.0 | Vulnerability Management Policy |
DCF-297 | Critical Security Updates Installed Timely | PCI 3.2.1,NIST SP 800-53r5,NIST CSF,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Vulnerability Management Policy |
DCF-30 | Incident Response Lessons Learned Documented | SOC 2,ISO 27001:13,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Incident Response Plan |
DCF-304 | Test Data Removed before System Activation | PCI 3.2.1,NIST SP 800-53r5,FedRAMP,PCI 4.0 | Change Management Policy,Software Development Life Cycle Policy |
DCF-305 | Production Components Change Control Procedures | PCI 3.2.1,NIST AI RMF,SOC 2,ISO 27001:22,PCI 4.0 | Change Management Policy |
DCF-310 | PCI Requirements Validation Upon Changes | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-312 | Periodic Secure Code Development Training | PCI 3.2.1,ISO 27001:22,NIST SP 800-53r5,NIST CSF,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Software Development Life Cycle Policy,Change Management Policy |
DCF-32 | Security Policies | SOC 2,ISO 27001:13,PCI 3.2.1,GDPR,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,FedRAMP,ISO 27017:15,PCI 4.0 | Acceptable Use Policy,Business Continuity Plan,Code of Conduct,Encryption Policy,Incident Response Plan,Information Security Policy,Asset Management Policy,Backup Policy,Data Classification Policy,Data Retention Policy,Data Protection Policy,Disaster Recovery Plan,Password Policy,Physical Security Policy,Risk Assessment Policy,Software Development Life Cycle Policy,System Access Control Policy,Vendor Management Policy,Vulnerability Management Policy,PCI DSS Compliance Policy,Logging and Monitoring Policy,Network Security Policy |
DCF-324 | Public-Facing Web Application Vulnerability Assessment | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-326 | Need-to-Know Principle | PCI 3.2.1,NIST SP 800-53r5,CCM,NIST SP 800-171r2,FedRAMP,PCI 4.0 |
|
DCF-329 | Access Control System in Place | PCI 3.2.1,CCPA,CPRA,PCI 4.0 | System Access Control Policy |
DCF-33 | Periodic Policy Reviews | SOC 2,ISO 27001:13,HIPAA,ISO 27001:22,CCM,NIST CSF,ISO 27017:15,PCI 4.0 | Information Security Policy,ISMS Plan (2013 and 2022) |
DCF-335 | Inactive User Accounts Removed | PCI 3.2.1,NIST SP 800-53r5,FedRAMP,PCI 4.0 | System Access Control Policy |
DCF-336 | Third Party Remote Access Monitored | PCI 3.2.1,NIST SP 800-53r5,NIST CSF,NIST SP 800-171r2,FedRAMP,PCI 4.0 | System Access Control Policy |
DCF-339 | Account Lockout after Failed Logins | PCI 3.2.1,PCI 4.0,SOC 2,HIPAA,ISO 27001:22 | Password Policy |
DCF-340 | Lockout Duration | PCI 3.2.1,PCI 4.0 | Password Policy |
DCF-343 | Strong Encryption of Authentication Credentials During Transmission and Storage | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-345 | User Identity Verification Before Modifying Authentication | PCI 3.2.1,CCPA,CPRA,PCI 4.0 | System Access Control Policy |
DCF-346 | Minimum Strong Password Requirements | PCI 3.2.1,PCI 4.0 | Password Policy |
DCF-348 | Periodic Password Change for In-Scope Components Not In the CDE | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-349 | Guidance Provided to Customers for Password Changes | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-350 | Password History Enforcement | PCI 3.2.1,PCI 4.0,SOC 2,HIPAA,ISO 27001:22 | Password Policy |
DCF-352 | Unique First-time Passwords With One-Time Use | PCI 3.2.1,ISO 27001:22,Cyber Essentials,PCI 4.0 | Password Policy |
DCF-354 | MFA for Non-Console Admin Access | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-355 | MFA for Remote Network Access | PCI 3.2.1,NIST SP 800-53r5,NIST CSF,FedRAMP,CCPA,CPRA,PCI 4.0 | System Access Control Policy |
DCF-356 | Authentication Policy Inclusions | PCI 3.2.1,ISO 27001:22,NIST SP 800-53r5,FedRAMP,PCI 4.0 | Password Policy |
DCF-358 | Unique Authentication Credential for Service Providers with Remote Access | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-36 | Periodic Security Training | SOC 2,ISO 27001:13,HIPAA,PCI 3.2.1,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,Cyber Essentials,PCI 4.0 | Information Security Policy |
DCF-360 | Direct Query Access Restricted | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-363 | Entry Controls in Place | PCI 3.2.1,NIST SP 800-53r5,CCM,NIST CSF,FedRAMP,PCI 4.0,SOC 2,ISO 27001:22 | Physical Security Policy |
DCF-365 | Secure Physical Access Control Mechanisms | PCI 3.2.1,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,FedRAMP,SOC 2,PCI 4.0 | Physical Security Policy |
DCF-366 | Physical Access Control Mechanism Periodic Data Review | PCI 3.2.1,NIST SP 800-53r5,CCM,FedRAMP,PCI 4.0 | PCI DSS Compliance Policy,Physical Security Policy |
DCF-367 | Physical Access Control Mechanism Data Retention | PCI 3.2.1,NIST SP 800-53r5,CCM,FedRAMP,PCI 4.0 | Physical Security Policy |
DCF-368 | Restricted Physical Access to Publicly Accessible Network Jacks | PCI 3.2.1,NIST SP 800-53r5,CCM,FedRAMP,PCI 4.0 | PCI DSS Compliance Policy,Physical Security Policy |
DCF-369 | Restricted Physical Access to Network Components | PCI 3.2.1,CCM,SOC 2,ISO 27001:22,PCI 4.0 | Physical Security Policy |
DCF-372 | Restricted Access to Badge System | PCI 3.2.1,PCI 4.0 | Physical Security Policy |
DCF-374 | Visitors Authorized and Escorted | PCI 3.2.1,CCM,SOC 2,ISO 27001:22,PCI 4.0 | Physical Security Policy |
DCF-375 | Personnel and Visitor Badges | PCI 3.2.1,CCM,PCI 4.0,SOC 2,ISO 27001:22 | Physical Security Policy |
DCF-377 | Visitor Badge Control | PCI 3.2.1,CCM,SOC 2,ISO 27001:22,PCI 4.0 | Physical Security Policy |
DCF-378 | Visitor Log | PCI 3.2.1,NIST SP 800-53r5,CCM,FedRAMP,SOC 2,ISO 27001:22,PCI 4.0 | Physical Security Policy |
DCF-379 | Visitor Log Inclusions | PCI 3.2.1,NIST SP 800-53r5,CCM,FedRAMP,PCI 4.0 | Physical Security Policy |
DCF-380 | Visitor Log Retention | PCI 3.2.1,NIST SP 800-53r5,CCM,FedRAMP,PCI 4.0 | Physical Security Policy |
DCF-381 | Media Physically Secured or Encrypted | PCI 3.2.1,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Data Protection Policy,Physical Security Policy |
DCF-382 | Security of Offline Media Backup Storage | PCI 3.2.1,NIST SP 800-53r5,FedRAMP,PCI 4.0 | Physical Security Policy |
DCF-384 | Media Classification | PCI 3.2.1,NIST SP 800-53r5,CCM,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Data Classification Policy |
DCF-385 | Media Transferred Securely | PCI 3.2.1,NIST SP 800-53r5,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Public Cloud PII Protection Policy,Data Protection Policy |
DCF-386 | Management Approval for Media Transfer | PCI 3.2.1,PCI 4.0,SOC 2,HIPAA,ISO 27001:22 | Data Protection Policy,Public Cloud PII Protection Policy |
DCF-388 | Media Inventory Logs | PCI 3.2.1,NIST SP 800-53r5,FedRAMP,PCI 4.0 | Data Protection Policy,PCI DSS Compliance Policy |
DCF-39 | Background Checks | SOC 2,ISO 27001:13,HIPAA,PCI 3.2.1,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Information Security Policy |
DCF-390 | Media Destruction | PCI 3.2.1,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,PCI 4.0,ISO 27001:22 | Data Retention Policy |
DCF-391 | Media Destruction Policies and Procedures | PCI 3.2.1,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Data Retention Policy |
DCF-397 | Payment Card Capture Devices Periodic Inspection | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-404 | Training Material for Payment Card Capture Device Tampering Awareness | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-406 | Audit Trails Enabled and Active | PCI 3.2.1,NIST SP 800-53r5,NIST SP 800-171r2,FedRAMP,PCI 4.0 | PCI DSS Compliance Policy,Logging and Monitoring Policy |
DCF-407 | Audit Logs Data Points | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy,Logging and Monitoring Policy |
DCF-408 | Audit Trail for Individual User Access to Cardholder Data | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-409 | Audit Trail for Admin Privileged Access | PCI 3.2.1,NIST SP 800-53r5,CCM,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Logging and Monitoring Policy,PCI DSS Compliance Policy |
DCF-410 | Audit Trail Access Logging | PCI 3.2.1,NIST SP 800-53r5,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Logging and Monitoring Policy |
DCF-411 | Audit Trail for Invalid Access Attempts | PCI 3.2.1,NIST SP 800-53r5,FedRAMP,PCI 4.0 | Logging and Monitoring Policy,PCI DSS Compliance Policy |
DCF-412 | Audit Trail for Identification and Authentication Mechanism Changes | PCI 3.2.1,NIST SP 800-53r5,FedRAMP,PCI 4.0 | Logging and Monitoring Policy,PCI DSS Compliance Policy |
DCF-413 | Audit Trail of Changes to Audit Logs | PCI 3.2.1,NIST SP 800-53r5,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Logging and Monitoring Policy,PCI DSS Compliance Policy |
DCF-414 | Audit Trail of System-Level Object Creation or Deletion | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-42 | Defined Roles and Responsibilities | SOC 2,ISO 27001:13,HIPAA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,ISO 27017:15,PCI 4.0 | Information Security Policy,ISMS Plan (2013 and 2022) |
DCF-421 | Clock Synchronization | PCI 3.2.1,NIST SP 800-53r5,CCM,NIST SP 800-171r2,FedRAMP,ISO 27017:15,PCI 4.0 |
|
DCF-422 | Time-related System Parameters | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy,Logging and Monitoring Policy |
DCF-423 | Time Server Peering | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-424 | System Time Source | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-425 | Need-to-Know Access to Time Data | PCI 3.2.1,NIST SP 800-53r5,FedRAMP,PCI 4.0 | Logging and Monitoring Policy |
DCF-426 | Time Settings Changes Logged, Monitored, Reviewed | PCI 3.2.1,PCI 4.0 | Logging and Monitoring Policy |
DCF-429 | Limited Access to Audit Trails | PCI 3.2.1,NIST SP 800-53r5,NIST SP 800-171r2,FedRAMP,PCI 4.0,ISO 27001:22 | Logging and Monitoring Policy,PCI DSS Compliance Policy |
DCF-430 | Audit Trail Files Protected | PCI 3.2.1,NIST SP 800-53r5,NIST SP 800-171r2,FedRAMP,PCI 4.0,ISO 27001:22 | Logging and Monitoring Policy,PCI DSS Compliance Policy |
DCF-431 | Audit Trail Files Backed Up | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy,Logging and Monitoring Policy |
DCF-434 | Policies and Procedures for Logging | PCI 3.2.1,PCI 4.0 | Logging and Monitoring Policy,PCI DSS Compliance Policy |
DCF-435 | Critical System Logs Reviewed Daily | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-437 | Periodic Review of Non-Critical Logs | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-438 | Follow-up Procedures on Log Review Anomalies and Exceptions | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-441 | Audit Log Retention Period | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-444 | Critical Security Control System Failure Alert | PCI 3.2.1,NIST SP 800-53r5,NIST CSF,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Logging and Monitoring Policy |
DCF-445 | Critical Security Control System Failure Response | PCI 3.2.1,NIST SP 800-53r5,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Logging and Monitoring Policy |
DCF-448 | Wireless Access Point Detection and Identification | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-452 | Inventory of Authorized Wireless Access Points | PCI 3.2.1,NIST SP 800-53r5,NIST SP 800-171r2,FedRAMP,PCI 4.0 | PCI DSS Compliance Policy |
DCF-454 | Actions Against Unauthorized Wireless Access Points | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-455 | Internal Vulnerability Scans (PCI) | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-456 | Vulnerabilities Identified and Resolved | PCI 3.2.1,Cyber Essentials,PCI 4.0 | PCI DSS Compliance Policy,Vulnerability Management Policy |
DCF-458 | Quarterly External Vulnerability Scans (PCI) | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-46 | Formal Recruiting Process | SOC 2,ISO 27001:13,PCI 3.2.1,ISO 27001:22,PCI 4.0 | Information Security Policy |
DCF-461 | External Vulnerability Scans After Significant Change | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-463 | Internal Vulnerability Scans by Competent and Independent Party | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-464 | Penetration Testing Methodology | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-465 | External Penetration Testing Requirements | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy,Vulnerability Management Policy |
DCF-467 | Internal Penetration Testing Requirements | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-469 | Resolving Vulnerabilities from Penetration Testing | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-470 | Periodic Penetration Testing on Segmentation Controls | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-473 | Periodic Segmentation Control Penetration Testing | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-477 | IDS/IPS Up to Date | PCI 3.2.1,CCM,PCI 4.0 | Network Security Policy |
DCF-478 | Change Detection Mechanism in Place | PCI 3.2.1,NIST SP 800-53r5,NIST CSF,NIST SP 800-171r2,FedRAMP,ISO 27017:15,PCI 4.0,ISO 27001:22 | Logging and Monitoring Policy |
DCF-479 | Periodic Critical File Comparisons | PCI 3.2.1,NIST CSF,PCI 4.0 | PCI DSS Compliance Policy |
DCF-48 | Screen Lockout | SOC 2,ISO 27001:13,HIPAA,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,Cyber Essentials,PCI 4.0 | System Access Control Policy |
DCF-482 | Acceptable Use Policy for End-User Technologies | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-493 | PCI DSS Compliance Program Charter | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-496 | Designated Information Security Official | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-499 | Incident Response Plan (PCI) | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy,Incident Response Plan |
DCF-5 | Change Review Process | SOC 2,ISO 27001:13,ISO 27001:22,NIST SP 800-53r5,CCM,FedRAMP,PCI 4.0 | Software Development Life Cycle Policy,Change Management Policy |
DCF-50 | Malware Detection Software Installed | SOC 2,ISO 27001:13,HIPAA,PCI 3.2.1,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,NIST CSF,FedRAMP,Cyber Essentials,PCI 4.0 | Acceptable Use Policy,Asset Management Policy,Vulnerability Management Policy |
DCF-503 | Multiple Methods for Security Awareness | PCI 3.2.1,NIST SP 800-53r5,FedRAMP,HIPAA,PCI 4.0 | Information Security Policy |
DCF-504 | Cardholder Data Security Awareness Training | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-507 | Vendor Due Diligence | PCI 3.2.1,PCI 4.0,ISO 27001:22,SOC 2 | Vendor Management Policy |
DCF-509 | Documented PCI DSS Responsibilities of Service Providers | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-510 | Service Providers Acknowledge Security Responsibilities | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-516 | Security Incident Response Training | PCI 3.2.1,CCM,PCI 4.0 | PCI DSS Compliance Policy,Information Security Policy |
DCF-517 | Monitoring Procedures for System Alerts | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy,Incident Response Plan |
DCF-519 | PCI DSS Compliance Periodic Reviews | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-521 | PCI DSS Compliance Periodic Reviews Documentation | PCI 3.2.1,PCI 4.0 | PCI DSS Compliance Policy |
DCF-54 | Encryption at Rest | SOC 2,ISO 27001:13,HIPAA,GDPR,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Data Protection Policy |
DCF-55 | Encryption of Data In Transit | SOC 2,ISO 27001:13,HIPAA,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Data Protection Policy |
DCF-557 | Shared Account Management | ISO 27001:22,NIST SP 800-53r5,FedRAMP,PCI 4.0 | System Access Control Policy |
DCF-56 | Vendor Register and Agreements | SOC 2,ISO 27001:13,HIPAA,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,FedRAMP,ISO 27017:15,PCI 4.0 | Vendor Management Policy |
DCF-562 | Procedures for Utility Program Use | ISO 27001:22,ISO 27017:15,SOC 2,PCI 4.0 | System Access Control Policy |
DCF-57 | Vendor Compliance Monitoring | SOC 2,ISO 27001:13,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,FedRAMP,NIST AI RMF,PCI 4.0 | Vendor Management Policy |
DCF-59 | Privileged Access Restricted | SOC 2,ISO 27001:13,HIPAA,PCI 3.2.1,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,Cyber Essentials,ISO 27017:15,PCI 4.0 | System Access Control Policy,Public Cloud PII Protection Policy |
DCF-6 | Production Changes Restricted | SOC 2,ISO 27001:13,ISO 27001:22,NIST SP 800-53r5,CCM,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Software Development Life Cycle Policy,Change Management Policy |
DCF-61 | Customer Data Segregation | SOC 2,ISO 27017:15,PCI 4.0 | Data Protection Policy |
DCF-62 | Inactivity and Browser Exit Logout | SOC 2,ISO 27001:13,HIPAA,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,NIST SP 800-171r2,FedRAMP,PCI 4.0 | System Access Control Policy |
DCF-637 | Secure Development Process | NIST SP 800-53r5,CCM,FedRAMP,PCI 4.0 | Software Development Life Cycle Policy |
DCF-67 | Multi-Factor Authentication | SOC 2,ISO 27001:13,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,Cyber Essentials,PCI 4.0 | System Access Control Policy |
DCF-68 | Password and Authentication Configurations | SOC 2,ISO 27001:13,HIPAA,PCI 3.2.1,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,Cyber Essentials,ISO 27017:15,PCI 4.0 | Password Policy,System Access Control Policy |
DCF-69 | Access Provisioning | SOC 2,ISO 27001:13,HIPAA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,Cyber Essentials,PCI 4.0 | System Access Control Policy |
DCF-7 | Separate Testing and Production Environments | SOC 2,ISO 27001:13,PCI 3.2.1,ISO 27001:22,NIST SP 800-53r5,NIST CSF,FedRAMP,PCI 4.0 | Software Development Life Cycle Policy,Change Management Policy |
DCF-70 | Terminated Personnel Access Revoked Timely | SOC 2,ISO 27001:13,HIPAA,PCI 3.2.1,CCPA,CPRA,ISO 27001:22,CCM,NIST CSF,Cyber Essentials,PCI 4.0 | System Access Control Policy,Public Cloud PII Protection Policy |
DCF-71 | Unique Accounts Used | SOC 2,ISO 27001:13,HIPAA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,Cyber Essentials,ISO 27017:15,PCI 4.0 | System Access Control Policy |
DCF-8 | External Communication Channels | SOC 2,ISO 27001:13,NIST SP 800-53r5,NIST SP 800-171r2,FedRAMP,PCI 4.0 |
|
DCF-85 | Network Security Controls | SOC 2,ISO 27001:13,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,Cyber Essentials,PCI 4.0 | Network Security Policy |
DCF-88 | Web Application Firewall | SOC 2,ISO 27001:13,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,FedRAMP,Cyber Essentials,PCI 4.0 | Network Security Policy |
DCF-91 | IDS/IPS Implemented | SOC 2,ISO 27001:13,HIPAA,PCI 3.2.1,CCPA,CPRA,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,NIST SP 800-171r2,FedRAMP,PCI 4.0 | Network Security Policy |
DCF-94 | Physical Security Policy | SOC 2,ISO 27001:13,HIPAA,PCI 3.2.1,GDPR,ISO 27001:22,NIST SP 800-53r5,CCM,NIST CSF,FedRAMP,PCI 4.0 | Physical Security Policy |