The following is a list of example evidence for controls not monitored in Drata for SOC 2.
Note: An auditor may request additional evidence for each control.
Code | Name | Example Evidence |
DCF-5 | Code Repository Controls | Upload evidence of the branch protection settings for relevant code repositories used in production. |
DCF-5 | Software Development Change Control | For an example change (e.g., software development change), upload evidence showing that the change was reviewed, tested, and approved with segregation of duties prior to deployment to production. |
DCF-6 | Change Deployers | Upload evidence showing users with access to deploy changes to production. |
DCF-7 | Separate Testing and Production Environments | Upload evidence showing separate environments exist for development, testing, staging, and production as applicable. |
DCF-8 | External Communication Channels | Upload evidence of communication channels available to customers to report issues, bugs, suspected incidents, etc. |
DCF-9 | Internal Communication Channels | Upload examples of internal communication channels for employees to report failures, events, incidents, concerns, and other issues. |
DCF-11 | User Access Review | Upload documentation of the most recent user access and permissions review.
|
DCF-12 | Baseline Configuration and Hardening Standards | Upload evidence of your documented baseline security configuration and hardening standards such as industry-accepted hardening standards or vendor recommendations and evidence that these are implemented (for example, through infrastructure as code). Examples of industry-accepted baseline security configurations and hardening standards include:
|
DCF-14 | Organizational Chart | Upload your current organizational chart (e.g., screenshot or export from HRMS showing personnel, their job title, department, reporting lines, etc). |
DCF-16 | Risk Assessment Results | Upload documentation of the most recent risk assessment activities performed (e.g., risk register, risk treatment plan) in accordance with company policies and compliance requirements.
|
DCF-19 | Penetration Test | Upload evidence of the most recent penetration testing activities.
|
DCF-20 | Asset Inventory | 1. Formal, documented listing of all assets (workstations, mobile devices, servers, databases, etc.) |
DCF-21 | Architecture Diagram | Upload evidence of your current architecture diagram(s) and evidence of updates/reviews within the past year for accuracy (e.g., emails from responsible personnel confirming the accuracy and completeness of the architecture diagram(s), etc.) |
DCF-22 | Network Diagram | Upload evidence of your current network diagram(s) and evidence of updates/reviews within the past year for accuracy (e.g., emails from responsible personnel confirming the accuracy and completeness of the network diagram(s), etc.) |
DCF-26 | Business Continuity/Disaster Recovery Test | Upload evidence of your most recent business continuity and/or disaster recovery test. |
DCF-28 | Incident Documentation | For an example security event deemed an incident, upload the incident documentation including evidence of internal tracking (e.g., internal ticket), root-cause analysis (RCA)/post-mortem, lessons learned, etc. |
DCF-29 | Incident Response Roles and Responsibilities | Upload evidence of your documented roles and responsibilities for incident response.
|
DCF-38 | Employee Performance Review | Upload an example of a completed performance evaluation for a member of personnel performed within the past year showing components of the evaluation process (e.g., self-reviews, peer-reviews, manager-reviews, etc.). |
DCF-41 | Board Charter | Upload the current board of directors charter outlining board membership and responsibilities (e.g., committees, if applicable). |
DCF-46 | Formal Screening Process | Upload evidence of the formal interview/recruitment process for a recently hired personnel. |
DCF-47 | Job Descriptions | Upload documented job descriptions for both a recently hired personnel and an existing personnel. |
DCF-56 | Vendor Agreement | Upload evidence of an example executed agreement with a vendor or service provider. |
DCF-57 | Vendor Register and Agreements | 1. Executed Agreement/contract between the entity and key vendors. |
DCF-59 | Administrative Users | Upload screenshots or exports of user lists (with a screenshot of parameters used for exporting) showing the users with administrative or privileged access to the systems (e.g., super users, administrators, power users, etc.) for relevant systems. |
DCF-60 | Secure Secret Storage | Upload evidence showing that stored secrets (e.g., user passwords, API keys, etc) are managed securely. |
DCF-61 | Customer Data Segregation | Upload evidence showing customer data is segregated. |
DCF-62 | Application Logoff | Upload evidence of automated logoff for relevant systems/applications. For example:
|
DCF-63 | Terms of Service | Upload evidence of your terms of service available online, as well as screenshots of the account sign up process showing users are required to accept the terms of service prior to using the system. |
DCF-65 | Public Privacy Policy/Notice | Add a link to your publicly available privacy policy/notice.
Additional information may be required in the privacy policy to comply with privacy-specific legislation depending on the relevant jurisdiction. Consult with legal counsel. |
DCF-66 | Executed MSA | Upload evidence of a recently executed service agreement with a customer. |
DCF-67 | Multi-Factor Authentication | Upload screenshots of the multi-factor authentication configurations for relevant systems (where not integrated with Drata). If MFA is enforced on a per-user level instead of a global setting, upload evidence showing all users have MFA enabled. |
DCF-68 | Password Configurations | Upload evidence of the password requirements enforced for relevant systems to demonstrate are implemented in accordance with company policy. |
DCF-69 | Access Provisioning | Upload an example record of access request and approval for a user to be granted permission to a system. |
DCF-70 | Termination/Offboarding | Upload evidence showing the offboarding activities for one recently terminated personnel (e.g., offboarding checklist, IT or help desk ticket). |
DCF-72 | Root Password Login Disabled | Upload evidence showing that root password authentication to production resources (e.g., virtual machines, containers, etc.) is disabled. |
DCF-74 | Communication of Changes | Upload examples of communication of system changes to customers (e.g., release notes, change log, communications sent out to customers via email, etc.) |
DCF-76 | Hot Fixes/Emergency Changes | For a hot fix or emergency change, upload evidence to show that the change followed the standard change management process (reviews, testing and approval) or that it was reviewed and approved by an authorized individual after implementation. |
DCF-77 | Backup and Retention Configurations | Upload evidence showing back-up and retention configurations for production databases (e.g., screenshots showing backup frequency and window, retention period, etc.). |
DCF-79 | Logging System | Screenshots from the location where logs of system activity are stored. |
DCF-85 | Network Security Configurations | Upload evidence of network security configurations. |
DCF-88 | Web Application Firewall (WAF) | Upload evidence of web application firewall (WAF) configurations (for example, screenshots showing active WAF rulesets, etc.) |
DCF-91 | Intrusion Detection/Prevention System | 1. Screenshots from AWS GuardDuty, Azure Sentinel, GCP Security Command Center or equivalent monitoring tool showing that the service is enabled. |
DCF-92 | Encrypted Connections for Remote Access | Upload evidence that remote access to production resources is only available through an encrypted connection. |
DCF-95 | Processing Capacity Monitoring | Upload evidence of processing capacity monitoring (e.g., screenshots from observability and telemetry tools showing dashboards for utilization metrics, screenshot of alert configurations for resource utilization, etc). |
DCF-97 | Autoscaling | Screenshot of auto scaling configurations for EC2 instances. |
DCF-99 | Backup Monitoring | 1. Automated configurations from the backup service for notifying personnel when backup processes fail. |
DCF-100 | Backup Restoration Test | Upload evidence of your most recent test restore of backed-up data completed within the past year. |
DCF-103 | Customer Data Deletion | For a recently churned customer, upload evidence showing that customer data disposal was conducted in accordance with the contractual agreements with the customer. |
DCF-104 | Test Data in Lower Environments | Upload evidence showing that production data is not used in testing, staging or other lower environments. |
DCF-105 | Employee NDA | Upload an example executed agreement addressing confidentiality with recently hired employee (e.g., NDA, PIIA, employment agreement including confidentiality clauses, etc.) |
DCF-105 | Third Party NDA | Upload an example executed agreement with a third party (e.g., vendor, contractor, business partner, etc.) addressing confidentiality. |
DCF-107 | Disposal of Sensitive Data on Paper | 1. Observation of hard copy material being disposed |
DCF-108 | Secure Storage Mechanisms | 1. Pictures of secure storage bins from office locations. |
DCF-109 | Disposal of Data on Hardware | Upload evidence for one instance of data disposal on hardware showing that data was disposed securely. |
DCF-110 | Acceptable Input Ranges | 1. Screenshots of users entering data into the application to confirm that the application limits input values to only valid values. |
DCF-111 | Mandatory Fields | 1. Screenshots of user entering data into the application to confirm that the application requires mandatory data to be entered. |
DCF-112 | Explicit Acknowledgement of Privacy Policy/Notice | Upload screenshots of the account sign up process for your system or application(s) showing users are required to accept the privacy policy/notice prior to using the system. |
DCF-120 | Privacy Policy Changes Communication | For any recent changes to the public privacy policy, upload evidence showing customers were notified of such changes (Example: screenshots of email notifications sent to customers notifying them of changes to the privacy policy, etc.) and that the privacy policy includes the date the privacy policy was last updated (Example: screenshot or export of the public privacy policy showing last update date). |
DCF-120 | Review of Privacy Policy | Upload evidence of the most review of the online privacy policy/notice to show the policy has been reviewed within the past year. |
DCF-122 | Requests for Deletion of PII | For an example personal information data deletion request from a data subject, upload evidence showing that the request was fulfilled by permanently and completely erasing the personal information from its existing systems or de-identifying the personal information within the timelines established by regulatory requirements and confirmation was provided to the data subject. |
DCF-123 | Procedures for Information Disposal | Upload your documented procedures for erasure or destruction of information that has been identified for disposal. |
DCF-126 | Users Can Update their Information | Upload evidence to show that system users can view, correct, and/or delete their personal information by authenticating into the system with a username and password and navigating to their profile settings (e.g., screenshots from the system interface showing that users have the ability to view and edit their personal information from their account profile, etc.). |
DCF-127 | Privacy Requirements Communicated to Third parties | Upload your organization's vendor agreement template or an example executed agreement showing that specific instructions or requirements for handling personal information, including requirements and procedures to notify your organization of breaches or unauthorized disclosures, are communicated to third parties to whom personal information is disclosed. |
DCF-130 | Documentation of Breaches or Unauthorized Disclosures of PII | For any personal data breaches or unauthorized disclosures of PII, upload evidence showing that documentation is retained including the facts relating to the personal data breach or disclosure, its effects and impact, and the remedial action taken (e.g., post-mortem report documenting the facts of the breach or unauthorized disclosures and subsequent actions taken, etc.) |
DCF-135 | Notification of Incidents or Breaches | For one example security incident or breach, upload evidence showing that notification of the incident or breach was given to affected parties and authorities (as applicable) in accordance with company policies and procedures and contractual and legal obligations. |
DCF-136 | Communication of Use of Subprocessors | Upload evidence showing that the subprocessors used to process PII are communicated to customers (e.g., screenshots a list of subprocessors posted on the company website, template data processing agreement showing list of subprocessors incorporated as an appendix, etc.). |
DCF-140 | Point of Contact for Privacy Inquiries | Upload evidence showing that the organization provides a contact mechanism for data subjects to submit privacy-related requests or report privacy incidents (e.g., email address for privacy inquiries communicated via agreements or through the company website, etc.). |
DCF-141 | Privacy Inquiries Tracked | Upload evidence showing that privacy right requests are tracked internally (e.g., in ticket or log format). |
DCF-146 | Board Meeting Minutes | Upload the meeting agenda and minutes for the most recent board of directors meeting, showing date, participants, topics discussed, etc. |
DCF-149 | Removable Media Device Encryption | 1. If removable media devices are issued by the company to employees, provide evidence that removable media devices are encrypted. |
DCF-150 | Data Leakage Prevention | Upload evidence of the data leakage prevention (DLP) measures implemented in the organization (e.g., screenshots of DLP rules implemented in corporate email service, configurations from DLP tools in place, etc.) |
DCF-152 | Automated Operating System Upgrades | Upload evidence showing that automated mechanisms have been implemented to install security upgrades to operating systems (e.g., screenshots showing unattended upgrades, apt-get-update / apt-get-upgrades within infrastructure as code configuration files, screenshots of management console for patch management tools such as Automox, etc.) |
DCF-154 | Incident Response Test | Upload evidence of your most recently completed incident response test. |
DCF-156 | Change Release | For an example change release, upload evidence showing that the release was approved by authorized personnel prior to deployment to production (e.g., screenshot of a pull request/ticket showing approval for a release candidate by an authorized personnel). |
DCF-157 | Cyber Insurance | Upload your current certificate insurance showing errors and omissions policy and/or cyber insurance coverage (coverage amounts, policy validity dates). |
DCF-166 | Business Continuity Plan | 1. Business Continuity Plan. |
DCF-168 | Vendor Management Policy | Vendor Management Policy |
DCF-173 | Employment Contracts | For one example personnel, upload executed employment contracts/agreements outlining the terms and conditions of employment as well as responsibilities during and after employment (e.g., duty of confidentiality, return of assets, protection of intellectual property, etc.). |
DCF-182 | Asset Management Policy | Asset Management Policy |
DCF-204 | Dataflow Diagram | Upload evidence of your current dataflow diagram(s) and evidence of updates/reviews within the past year for accuracy (e.g., emails from responsible personnel confirming the accuracy and completeness of the dataflow diagram(s), etc.) |
DCF-273 | Strong Key Generation Policies and Procedures | 1. Documented key management procedures which specify how to generate strong cryptographic keys. |
DCF-278 | Key Retirement Policies and Procedures | 1. Documented key management procedures which include guidance for: |
DCF-293 | Anti-malware Capabilities | Upload evidence showing that the deployed anti-malware solution is kept via automatic updates and configured to detect all known types of malware and to remove, block, or contain all known types of malware. |
DCF-294 | Anti-malware Tools Behavior | Upload screenshots from your anti-malware solution console showing it is configured to perform periodic scans and active/real-time scans (e.g., scanning files from external sources as they are downloaded, opened, or executed) or to perform continuous behavioral analysis of systems or processes. |
DCF-305 | Production Components Change Control Procedures | For a non-software development change, upload documentation showing that the change was implemented in accordance with formal change management policies and procedures. For example, documentation of change description, justification, evaluation of security requirements and impact, approval by authorized parties, rollback procedures, etc., and records of testing (for example, acceptance and security impact testing). |
DCF-312 | Secure Code Development Training Record | Upload evidence of secure code development training completed by a member of personnel within the past year. |
DCF-340 | Account Lockout | Upload evidence of the account lockout configurations after failed login attempts for relevant systems where this is a configurable attribute, showing number of attempts that trigger the lockout and lockout duration. |
DCF-350 | Password History Enforcement | Upload evidence showing that system configuration settings are in place to prevent password reuse in accordance with company policy and compliance requirements for relevant systems. |
DCF-356 | Communication of Authentication Best Practices |
|
DCF-363 | Entry Controls in Place |
|
DCF-365 | Secure Physical Access Control Mechanisms | 1. Pictures showing how video cameras or access control mechanisms (or both) are protected from tampering and disabling. |
DCF-372 | Badge System Access | Upload evidence showing that access to the identification or badge system is restricted to authorized personnel based on need-to-know principles. |
DCF-374 | Visitors Authorized and Escorted | 1. Observation of a vistor being escorted when entering company facilities |
DCF-375 | Personnel and Visitor Badges | 1. Observation of visitor obtaining a visitor badge and example of a visitor badge |
DCF-377 | Visitor Badge Control | Pictures showing how visitors are required to surrender their visitor badges upon leaving the facility. |
DCF-378 | Visitor Log | Upload evidence to show that a visitor log is maintained to keep an audit trail of visitor activity to the company facilities, computer rooms or data centers where sensitive data may be stored or transmitted (e.g., scan or photograph of the visitor log for an example day, etc.) |
DCF-381 | Media Physically Secured or Encrypted | Documented policies and procedures related to physically securing all media (including computers, removable media, paper receipts, paper records, and faxes). |
DCF-406 | Audit Logging | Screenshots showing that audit trails are enabled and active for in-scope systems |
DCF-407 | Audit Logs Data Points | Upload evidence showing that audit logs have been configured to contain user or identity, type of event, date and time, success and failure indication, origination of event, affected data, and system component, resource, or service. |
DCF-409 | Audit Trail for Privileged Access | Upload evidence showing that audit trails or logs are implemented for system components to capture all actions taken by any identities with administrative access, including execution of privileged functions and any interactive use of application or system accounts. |
DCF-411 | Audit Trail for Invalid Access Attempts | Upload evidence showing that audit trails or logs are implemented for system components to capture invalid access attempts. |
DCF-412 | Audit Trail for Identification and Authentication Mechanism Changes | Upload evidence showing that audit trails or logs are implemented for system components to capture changes to identification and authentication credentials (e.g., creation of new accounts, elevation of privileges, changes, additions, or deletions to accounts with administrative access, etc.). |
DCF-414 | Audit Trail of System-Level Object Changes | Upload evidence showing that audit trails or logs are implemented for system components to capture capture all creation and deletion of system-level objects. |
DCF-478 | Change Detection Mechanism | 1. Screenshots from the change detection solution (such as File Integrity Monitoring) and relevant change detection system configurations showing what is monitored. |
DCF-503 | Periodic Security Updates | Upload evidence showing that periodic security updates are provided to personnel through different mechanisms (e.g., screenshots of internal newsletters or intranet with security reminders, security updates sent out via Slack or other internal communication channels, etc.) |
DCF-507 | Vendor Due Diligence | For any new service provider or vendor, you'll need to perform due diligence on (evaluate) them prior to engaging with them. Due diligence can consist of reviewing security questionnaires or obtaining confirmation that they have compliance certifications (such as a SOC 2). You should document the results of your due diligence as well as the day it was completed. |
DCF-522 | Anti-Malware Scans of Media | Upload evidence showing that the implemented anti-malware solution is configured to perform automatic scans or continuous behavioral analysis of systems or processes when removable electronic media is inserted, connected, or logically mounted within the environment. |
DCF-527 | Designated Data Protection Officer | Upload evidence showing that a data protection officer has been officially appointed (e.g., internal privacy policies, RACI matrix, job descriptions, etc. identifying the data protection officer, etc.). |
DCF-529 | Data Subject Consent | Upload evidence of your documented procedures for obtaining data subject consent for personal information collected directly from data subjects. |
DCF-531 | Records of Disclosures of Personal Information to Third Parties | Upload evidence of your documented records of disclosure of personal information to third parties, including an example notification to customers of any legally binding requests for disclosure of personal information. |
DCF-536 | Records of Processing Activities (ROPA) | Upload your documented records of processing activities (ROPA). |
DCF-537 | Data Processing Agreements with Subprocessors | Upload one example of an executed data processing agreement (DPA) with a subprocessor. |
DCF-540 | Timely Response to Privacy Matters | For an example privacy inquiry/request or reported suspected incident, upload evidence showing that the organization provided confirmation of receipt and responded to the request/inquiry or incident report within the timeframes established by regulatory requirements. |
DCF-541 | Procedures for Management of Data Subject Rights | Upload your documented policies and procedures for handling and responding to requests from data subjects to exercise their data subject rights with regards to personal information (e.g., documented procedures for responding to access rights requests, deletion requests, etc.) |
DCF-543 | Communication of Changes in Subprocessors | For any recent changes in subprocessors, upload evidence showing that changes were communicated to customers. |
DCF-549 | Identity Verification for Data Subject Requests | For one example data subject access request received by the organization, upload evidence showing that verification was done to confirm that the person making a privacy right request is the data subject or an authorized agent. |
DCF-557 | Shared Account Management | For any highly privileged shared accounts, upload evidence of the business justification and evidence of how these shared accounts are securely managed. |
DCF-558 | Restrictions on Software Installation | Upload evidence showing that the organization has implemented mechanisms to prevent the installation and use of unauthorized software in company-managed assets (e.g., screenshots from MDM tools showing rules preventing software installation are enforced on company devices, access controls limiting access to run executables, etc.) |
DCF-567 | Change Management Policy | Change Management Policy |
DCF-570 | Disciplinary Process | Upload your company's documented disciplinary process. The disciplinary process may be an HR-owned process available and communicated to employees through employee handbooks, code of conduct, etc, or included within an information security policy document.
The response should take into consideration relevant legal, statutory, regulatory contractual and business requirements as well as other factors as required. The disciplinary process should also be used as a deterrent to prevent personnel and other relevant interested parties from violating the information security policy, topic-specific policies and procedures for information security. Deliberate information security policy violations can require immediate actions |
DCF-571 | Fire Detection and Suppression | 1. Observation of fire detection and suppression systems installed in critical locations |
DCF-572 | Temperature Monitoring Systems | 1. Observation of systems in place to monitor and control air temperature and humidity at appropriate levels |
DCF-573 | Uninterruptible Power Supply | 1. Observation of uninterruptible power supply (UPS) systems in place for data centers or server rooms |
DCF-574 | Mobile Device Management Software | Upload evidence to show that a mobile device management (MDM) tool has been implemented to enforce security controls on mobile devices (e.g., screenshots from the MDM's centralized management console, screenshots of baseline configurations, security policies or blueprints enforced on devices per OS type, etc.) |
DCF-681 | Phishing Simulations | Upload evidence showing phishing simulations are conducted as part of the company's security awareness initiatives. |
DCF-684 | Redundancy of Processing | 1. Provide evidence that redundancy strategies were implemented for equipment, systems and processes as deemed necessary per the business continuity plans |
DCF-688 | Return of Assets | For one recently terminated personnel, upload evidence showing that assets were returned to the company. |
DCF-689 | On-call Team | Upload evidence of on-call rotation schedule. |
DCF-691 | Marketing Express Consent | Upload evidence showing that consent for marketing and advertising purposes is optional and not a condition for use of the system or service. |
DCF-712 | Static Application Security Testing | Upload evidence that static application security testing (SAST) is conducted for software development testing. |
DCF-741 | Logging and Monitoring Policy | 1. Logging and Monitoring Policy |
DCF-746 | Privacy Training | Upload evidence showing that a training program related to protection of personally identifiable information (PII) has been implemented (e.g., records of training materials such as presentations, videos, screenshots of the training content, etc., and records of completion for one example personnel). |
DCF-747 | Secure Logon Mechanisms for Customers | Upload evidence to show that customers are provided with the capabilities for secure log-on for any user accounts under their control (e.g., screenshots showing that customers can enable single sign-on, multi-factor authentication, and complex password requirements, screenshots showing passwords are masked when users attempt to login, screenshots showing minimal information disclosures in authentication error messages, etc.) |
DCF-748 | Segregation of Networks | Upload evidence showing that network segmentation or other techniques are used to split the network in security boundaries and to control traffic between them based on business and security needs. |
DCF-749 | Leak Detection System | 1. Observation of leak detection systems at critical facilities |
DCF-753 | Mechanisms to Object to Personal Information Processing | Upload evidence showing that your organization provides a mechanisms for data subjects to object to the processing of their personal information (e.g. objections relating to the processing of PII for direct marketing purposes, etc.). |
DCF-754 | Procedures for Data Subject Access Requests | Upload evidence of your documented procedures to respond to data subject right requests. |
DCF-756 | Dual Opt-In for Consent to Sell PII | If your organization sells personal information collected from data subjects to third parties, upload evidence that a dual opt-in mechanism is in place to receive consent from data subjects for the sale of personal information. |
DCF-757 | User and System Guides | Upload evidence showing that your organization provides user guides, help articles, system documentation or other resources to users to provide information about the design and operation of the system, functional and nonfunctional requirements related to system processing, information specifications required to support the use of the system, etc. (e.g., links to external documentation portal or help center, documented user guides, etc.). |
DCF-765 | Limit Collection of PII | For personal information collected directly from the data subjects, upload evidence showing that if the collection of that information is optional, the organization has disabled that option by default and only enabled by explicit choice of the data subject. |
DCF-774 | Data Processing Monitoring | For an example critical batch job, upload evidence showing that application/data processing is logged and monitored to ensure processing is done completely and accurately. |
DCF-775 | Cloud Deletion Protection | 1. Screenshots of the configuration enabled for deletion protection for cloud resources |
DCF-776 | Principle of Least Privilege | For each in-scope system / application, provide the user access listing with roles & permissions assigned to show that principle of least privilege has been implemented. |
DCF-777 | Cloud Resource Tagging | 1. Inventory listing with tags assigned |
DCF-778 | Fraud Risk Assessment | Upload evidence of your most recent risk assessment showing that the process includes fraud risk considerations (either as a separate evaluation or as part of the overall enterprise risk assessment).
Examples of controls that reduce the risk of fraud include, but are not limited to:
You must demonstrate to your auditor that your risk assessment included consideration of fraud risks and implementation of controls to mitigate the risk of fraud, based on your identification of the activities and processes within your organization which are the most vulnerable to fraud. |
DCF-779 | Cryptographic Key Rotation | Upload evidence of cryptographic key rotation processes implemented in accordance with defined company procedures. |
DCF-781 | Secure Login | For internally-developed systems, upload evidence showing that access to the system is done through a secure login procedure.
|
DCF-782 | Cloud Storage Lifecycle Rules | Upload evidence of any cloud storage lifecycle rules in place to delete data automatically after expiration of specified retention periods (e.g., screenshots from cloud storage showing configured expiration actions, etc.) |
DCF-783 | Secrets Rotation | Upload evidence of secrets rotation processes implemented in accordance with defined company procedures (e.g., screenshots of automated secrets rotation configurations in a secrets management systems, tickets or other documentation showing manual secrets rotation processes are carried out periodically, etc.) |
DCF-784 | Software Composition Analysis (SCA) | Upload evidence to show that your organization checks software components and libraries for policy and license compliance, security risks, and supported versions. |
DCF-785 | Secure Runtime Configurations | 1) Asset Management Policy |
DCF-786 | Defined Company Objectives | Upload evidence of your defined company objectives and how these are communicated to personnel.
|