SOC 2

SOC 2 is the framework under which an independent auditor reports on a service organization's controls against the AICPA's Trust Services Criteria. Pentr's YAML declares it as name SOC 2 Type II, version 2017, and its controls are criteria from the Common Criteria series.

Controls¶

The criteria the YAML declares, and the tables that reach each one. The Reached by column is explained on Frameworks.

Control	Name	Reached by
CC6.1	Logical and Physical Access Controls	ATT&CK, WSTG, keywords
CC6.2	User Access Management	ATT&CK, WSTG, keywords
CC6.3	Role-Based Access	ATT&CK, WSTG, keywords
CC6.6	System Boundaries	ATT&CK, keywords
CC6.7	Data Transmission Security	ATT&CK, WSTG, keywords
CC6.8	Malicious Software Prevention	ATT&CK, WSTG, keywords
CC7.1	Vulnerability Management	ATT&CK, WSTG, keywords
CC7.2	Security Event Monitoring	WSTG, keywords
CC8.1	Change Management	WSTG, keywords
CC9.1	Risk Mitigation	keywords

CC9.1 is reached through the keyword table alone. It is tested only by a finding whose ATT&CK and WSTG ids matched no row, and it never appears among the control ids in a sealed manifest.

ATT&CK technique mappings¶

Each ATT&CK technique id in the framework's table and the criteria it maps to. A finding tagged with one of these ids maps to every criterion in its row.

Technique	Controls
T1190	CC6.8, CC7.1, CC6.6
T1078	CC6.2, CC6.1
T1059	CC6.8, CC7.1
T1068	CC6.3, CC7.1
T1110	CC6.2, CC6.1
T1003	CC6.2, CC6.7
T1046	CC6.6, CC6.1
T1018	CC6.6
T1021	CC6.1, CC6.6
T1083	CC6.3

WSTG mappings¶

Each WSTG id in the framework's table and the criteria it maps to. A finding tagged with one of these ids maps to every criterion in its row.

WSTG id	Controls
WSTG-INPV-05	CC6.8, CC7.1
WSTG-INPV-01	CC6.8, CC7.1
WSTG-INPV-02	CC6.8, CC7.1
WSTG-ATHN-04	CC6.2, CC6.1
WSTG-ATHN-01	CC6.1, CC6.7
WSTG-IDNT-04	CC6.2
WSTG-CRYP-01	CC6.7
WSTG-CONF-01	CC8.1, CC7.2
WSTG-CONF-02	CC8.1, CC7.2
WSTG-ATHZ-01	CC6.3
WSTG-SESS-02	CC6.1
WSTG-ERRH-01	CC7.2

What Pentr does not attest to¶

• tested means at least one finding mapped to the criterion. It does not mean the criterion was assessed, met or failed. A mapping made by the keyword step can attach a criterion the finding does not bear on; see Frameworks.
• not_tested means no finding mapped to the criterion. It does not mean the criterion passed, and it says nothing about whether the criterion is in place.
• The mapping tables are Pentr's, written for the application. They are not published by the AICPA.
• A criterion that the YAML does not declare has no row in the report.
• The display name reads Type II, which describes a report on controls over an observation period. The test period a Pentr report prints is the run's start and end time.
• A Pentr report is not a SOC 2 report and not an audit opinion.

The product page for this framework is SOC 2.