Regulation × control × tooling.
A curated, browsable map: 56 concrete controls across 28 regulations, each with the tooling options that implement it and the evidence shape that passes audit. Designed so you can answer "which tool actually closes APRA CPS 234's workload-identity control, and what evidence do I produce?" in under a minute.
Tooling options
Evidence shape
IAM policy export showing zero static long-lived credentials in the path. OIDC trust policy showing federated identity provider configured. Rotation logs from any remaining service accounts (target: none in 12 months).
Notes
Often confused with credential rotation — rotation alone doesn't close the audit finding. The control requires federated identity (the workload proves who it is to the cloud), not just shorter-lived static creds. Foundation for SOCI 2022 SLACIP-amendment maturity.
Anti-pattern to avoid
Tooling options
Evidence shape
Static + runtime analysis report: count of wildcard (*) actions in production policies, trending to zero. AccessAnalyzer findings cleared monthly.
Notes
Wildcards in production IAM are the most common audit finding. The control is *demonstrated* least-privilege (Access Analyzer says so), not *intended* least-privilege.
Anti-pattern to avoid
Tooling options
Evidence shape
Just-in-time access requests log. Approval audit trail. Session recording for production breakglass. Account-of-last-resort tested quarterly.
Notes
E8 ML2+ requires PAM, not 'we have admins with persistent access we trust.'
Tooling options
Evidence shape
Conditional access policy export. Zero users with MFA-disabled status. WebAuthn / passkey adoption % trending up; SMS/voice OTP trending to zero.
Notes
SMS-OTP no longer counts as strong MFA per NIST SP 800-63B Revision 4 draft. Passkeys / hardware tokens are the target.
Tooling options
Evidence shape
Signed in-toto / SLSA provenance attached to every production artefact. Rekor transparency log entry for every signed artefact. Verification step in deploy pipeline that *blocks* if signature absent or invalid.
Notes
SLSA L2 = signed provenance; L3 = hardened builder (isolated, ephemeral). L3 needed for US-federal procurement under CISA SSA in many cases.
Anti-pattern to avoid
Tooling options
Evidence shape
SBOM per artefact stored centrally. CISA KEV catalogue subscribed; on match, owner-of-service alerted within minutes (not central security inbox). MTTR for KEV-listed CVEs measured and trending down.
Notes
Emitting SBOMs is necessary but not sufficient. The audit-passing control is the *loop*: SBOM → vulnerability → owner-alert → patch within SLA. Pure SBOM-collection = shelfware.
Anti-pattern to avoid
Tooling options
Evidence shape
Admission-controller logs showing rejection of unsigned/untrusted images. Policy-as-code repo defining trusted signers + repositories. Test workload with bad signature must fail.
Notes
Verifying signatures at deploy-time, not at scan-time. Catches the malicious-rebuild and tampered-mirror attack class.
Anti-pattern to avoid
Tooling options
Evidence shape
Same source produces byte-identical artefact across builds. Diffoscope output showing no drift. CI configured to reject non-hermetic dependencies.
Notes
Hard to reach for most teams; necessary for the most exposed federal / defence workloads (SLSA L4).
Tooling options
Evidence shape
Lockfile present + committed for every project. CI rejects builds whose lockfile is older than X weeks or where dependencies drift from lock.
Notes
Floating tags (:latest, ^1.x) make supply chain unsafe at any speed. Lockfile + freshness SLA is the control.
Tooling options
Evidence shape
Column-level lineage graph from source-of-truth to downstream consumers. BCBS 239 risk-aggregation reports traceable to source systems with timestamp.
Notes
BCBS 239 has been live since 2016 and is still failed by most G-SIBs at audit. Lineage at column level (not table level) is the bar.
Tooling options
Evidence shape
Time-bounded DSAR pipeline. Tested quarterly. Per-data-domain owners with documented response SLAs. Audit log of every DSAR fulfilled.
Notes
Statutory windows: GDPR 30 days, AU Privacy Act 30 days (under reform), HIPAA 30 days for access requests. Untested DSAR pipelines fail at first regulator-driven test.
Tooling options
Evidence shape
Every data asset tagged. Handling rules (encryption, retention, residency) inherited from classification. DLP rules tested via canary records.
Notes
The control is not 'we have a data classification standard'. It's 'every dataset wears its classification and the platform enforces handling rules.'
Tooling options
Evidence shape
Tenant-to-region routing table. Network policies that block egress to other regions. Sample request trace showing data stays in-region end-to-end.
Notes
Soft-residency (claim) vs hard-residency (architecturally enforceable). Auditors increasingly want the latter.
Tooling options
Evidence shape
Versioned eval set per prompt + model + version. CI run on every change that touches prompt or model. Merge blocked on critical-regression. Eval-set drift report quarterly.
Notes
EU AI Act Art. 15 (accuracy / robustness) is enforceable only with eval-set discipline. NIST AI RMF MEASURE function depends on it.
Anti-pattern to avoid
Tooling options
Evidence shape
Guardrail policy version-controlled. Adversarial-prompt suite run weekly against guardrail (not against base model). False-negative + false-positive rate tracked. Per-incident postmortem when guardrail breached.
Notes
Guardrails encoded in the system prompt = no guardrail. The control is a distinct layer that intercepts before & after the model.
Anti-pattern to avoid
Tooling options
Evidence shape
Per request: prompt, retrieved context, model + version, guardrails applied, output, latency, cost. Signed, immutable, retention-policy-controlled. Replay-able at any time.
Notes
EU AI Act Art. 12 (logging) becomes operational evidence here. Without per-decision logs you cannot answer regulator's 'why did the model decide X for this customer'.
Tooling options
Evidence shape
Trigger conditions documented (confidence threshold, risk tier, regulator-defined). Human reviewer queue with SLA. Audit trail showing human approval per decision.
Notes
Art. 14 (human oversight) is operational, not declarative. 'A human can override' isn't oversight; 'a human must approve high-risk decisions' is.
Tooling options
Evidence shape
Quarterly red-team report with documented attack categories. Pre-deploy adversarial test suite. CVE-equivalent tracking for AI vulnerabilities found.
Notes
OWASP LLM01 (prompt injection) is the most common attack vector; defending requires both input-side and output-side controls.
Tooling options
Evidence shape
Per model in production: model card (training data, eval results, intended use, limitations). Per dataset: data card (provenance, consent basis, refresh cadence). Both versioned with the model.
Notes
EU AI Act technical documentation (Art. 11 / Annex IV) maps to model + data cards.
Tooling options
Evidence shape
Per critical service: RTO + RPO defined. Recovery tested at least annually with timed result. Gap-to-target tracked. Multi-region failover rehearsed.
Notes
CPS 230 (live in AU FS) requires this for every 'critical operation'. DORA RTS expects testing artefacts the regulator can review.
Tooling options
Evidence shape
Vendor catalogue with criticality classification. Concentration risk (% of critical operations on one vendor) measured. Exit-plan for top-N critical vendors documented.
Notes
DORA introduced critical ICT third-party designation (CTPP). APRA CPS 230 has equivalent material-service-provider rules. Both need real numbers, not 'we use AWS'.
Tooling options
Evidence shape
Scheduled chaos experiments with documented blast radius. Hypothesis-driven (we expect X to happen; did it?). Postmortem when hypothesis was wrong.
Notes
DORA Art. 25 (threat-led penetration testing) implies dynamic resilience testing; chaos engineering is its operational analogue.
Tooling options
Evidence shape
Pre-templated regulator-notification drafts (per regulator). Drill quarterly: time from detection to draft sent. Audit trail of incident decisions.
Notes
US CIRCIA: 72h incident, 24h ransom payment. NIS2: 24h early-warning, 72h notification. SOCI 2018: critical infrastructure asset incidents 72h. The shape of the obligation is similar globally.
Tooling options
Evidence shape
Postmortem published within 14 days of every Sev-1/2. Action items tracked with closure-SLA. Quarterly read-back: themes, contributing factors, systemic gaps.
Notes
Action items that don't close = postmortems that don't compound. Google SRE Workbook Chapter 10 is the canonical reference.
Tooling options
Evidence shape
Per-CVE: detection time, patch-deployed time. MTTR for KEV-class trending below 14 days. Out-of-SLA list (in writing, with owner) for any gap.
Notes
CISA KEV is the actually-exploited subset; far better priority than CVSS-score alone.
Anti-pattern to avoid
Tooling options
Evidence shape
Per audit event: who, what, when, source. Retention per regulator (HIPAA 6 years; GDPR variable). Immutability proof (object-lock / write-once / hash-chain).
Notes
Local log files don't pass audit. Centralised + tamper-evident is the baseline.
Tooling options
Evidence shape
External scan (Qualys SSL Labs / testssl) showing A+ grade. Cipher allow-list documented. Audit log of any TLS-version-downgrade attempts.
Notes
PCI DSS 4.0 explicitly requires TLS 1.2+ (not 1.0/1.1) since 30 March 2025.
Tooling options
Evidence shape
Per-tenant key inventory. Key-rotation cadence enforced. Key-deletion as a real operation (crypto-shredding for tenant offboarding).
Notes
BYOK only meaningful if you can demonstrate the key is exclusive to one tenant and rotated independently.
Tooling options
Evidence shape
Pre-commit + push-time + retroactive scanning. Detected-secret-to-revocation MTTR. Quarterly retroactive scan of all repos.
Notes
A leaked secret rotated in 30 days is a breach. Auto-revocation pipeline matters more than detection.
Tooling options
Evidence shape
Per service: deployment shape (canary % · linear N-min · blue-green). Auto-rollback metrics defined. Recent rollback events with timing.
Notes
Big-bang prod deploys are a CPS 230 finding-in-waiting. Progressive deployment with auto-rollback is the operational standard.
Tooling options
Evidence shape
Endpoint policy export. Test execution of unsigned binary must be blocked. Exception list with owner + expiry.
Notes
E8 ML2+ requires application control. Hard to retrofit; bake into golden image / paved path.
Tooling options
Evidence shape
Per service: 4 golden signals dashboard inherited from paved path. SLO + error-budget per critical service. Alert quality (actionable-rate) ≥70%.
Notes
Inherited (paved path) beats per-team-set-up-their-own. The control is consistency across the fleet.
Tooling options
Evidence shape
Detection rules in git. PR-reviewed. CI-tested against historical events. Rule effectiveness reviewed monthly.
Notes
Detection-as-code beats SIEM-managed-by-vendor. Treats security like the engineering practice it is.
Tooling options
Evidence shape
Zone-and-conduit model documented (per IEC 62443-3-2). Inter-zone traffic logged. Conduits monitored. Unauthorised flow alerts.
Notes
IEC 62443 zone-and-conduit model is now the de-facto bar for OT/ICS environments. SOCI 2022 SLACIP-amendment audits ask after this.
Tooling options
Evidence shape
100% intra-cluster traffic encrypted (mesh dashboard). Strict mTLS mode (no plaintext fallback). Cert rotation cadence.
Notes
Service mesh is real platform investment. Adopt if 20+ services and a platform team; defer otherwise.
Tooling options
Evidence shape
Admission policy enforcing restricted PSS profile. No privileged: true in production. Exception list with owner + expiry.
Notes
Default-deny privileged execution; allow only with explicit exception. This is the bar Kubernetes Pod Security Standards 'restricted' enforces.
Tooling options
Evidence shape
Per quarter: every privileged user reviewed by a manager. Review evidence signed. Revocations logged with timing.
Notes
Manual UARs by spreadsheet collapse at scale. The control needs an attestation engine, not a Friday-afternoon Excel.
Tooling options
Evidence shape
Critical operations enumerated. Per operation: substitute (manual / backup / contracted alternative) tested. Tolerance for disruption set.
Notes
CPS 230 explicitly requires this. The 'tolerance for disruption' is the regulator's pet metric.
Tooling options
Evidence shape
BAA registry. Every vendor processing PHI on signed BAA. Annual review. Termination + data-return clauses tested.
Notes
Major cloud providers offer pre-signed BAAs; smaller vendors often forgotten and become the audit finding.
Tooling options
Evidence shape
PMS plan document. Adverse-event capture mechanism. Periodic safety update report (PSUR) cadence. Field-action procedure tested.
Notes
FDA expects PMS for any clinical AI. Maps to ISO 14971 risk management.
Tooling options
Evidence shape
Every infra change via PR. Plan-time policy check blocks bad configs (public S3, root-account use, untagged resources). Out-of-band changes alerted.
Notes
ClickOps in production = audit finding. IaC + plan-time policy is the bar.
Tooling options
Evidence shape
Daily / hourly drift report. Out-of-IaC changes alerted to owner. Closed-loop: drift → patched in code + applied, not patched in cloud alone.
Notes
Drift accumulates silently. Detection alone is necessary but not sufficient — the loop must close back to code.
Tooling options
Evidence shape
Per service / per tenant cost trend monthly. Cost spike (>30%) triggers owner alert. Cost-per-resolved-task / cost-per-transaction trending.
Notes
CPS 230 doesn't name cost explicitly, but financial sustainability of critical operations is in scope. FinOps Foundation Framework is the operational substrate.
Tooling options
Evidence shape
Crypto inventory (where is asymmetric crypto used). PQC transition plan with milestones. Pilot with hybrid (classical + PQC) on one critical path.
Notes
NIST finalised PQC standards Aug 2024 (FIPS 203/204/205). Regulators are starting to ask about transition plans.
Tooling options
Evidence shape
Per AI use-case: risk tier (per EU AI Act + internal taxonomy). Impact assessment signed. Review cadence + trigger events.
Notes
EU AI Act Art. 9 (risk management system). NIST AI RMF MAP function. ISO 42001 Annex A.6.1.
Tooling options
Evidence shape
All models scanned for serialised-code exploits. ML-BOM published per model. Training-data provenance documented.
Notes
Pickle files in shared model registries are an active attack surface. ML-supply-chain is the new software-supply-chain.
Tooling options
Evidence shape
Risk report → upstream system traceable. Adjustments logged. Materiality of each manual override classified.
Notes
G-SIBs were given BCBS 239 in 2013, due 2016, mostly still failing 2024 (BCBS reviews are public). The substrate is the gap, not the regulation.
Tooling options
Evidence shape
IRAP assessment letter from provider. Workload placement policy. Data egress controls preventing cross-region routing.
Notes
Up to PROTECTED on assessed regions; SECRET typically on sovereign-only platforms.
Tooling options
Evidence shape
Backup inventory + retention. Restore test quarterly. Immutability window > regulator-defined retention. Air-gap proven via network path test.
Notes
E8 ML2+ requires immutable + tested backups. Ransomware resilience is the underlying threat.
Tooling options
Evidence shape
Consent capture audit log per user. Revocation triggers downstream-system removal within N hours. Granularity matches actual purposes (not 'accept all').
Notes
Cookie banner alone doesn't satisfy. The control is propagation of revocation to every downstream consumer.
Tooling options
Evidence shape
VPN decommissioning roadmap (or done). Per-app access tied to identity + device posture. Audit log per access decision.
Notes
Always-on VPN is the legacy. ZTNA per-app, per-identity, per-posture is the bar.
Tooling options
Evidence shape
DNSSEC validated externally. CAA records limit cert issuance. SPF + DKIM + DMARC at p=reject. MTA-STS published.
Notes
Often skipped because 'we have HTTPS'; the DNS + email-auth controls close a different attack class.
Tooling options
Evidence shape
Per endpoint: auth method documented (API key / OAuth / mTLS). Rate-limit profile applied. Unauthenticated endpoints registry (intentional exceptions only).
Notes
OWASP API Security Top 10 (BOLA, BOPLA, broken auth) maps to deficiencies here. API gateway + auth-per-endpoint is the structural control.
Tooling options
Evidence shape
Patch compliance dashboard. % of fleet patched within N days of release. Out-of-SLA list with mitigation.
Notes
E8 ML2 requires 48-hour patching for working exploits, 1-month for known vulns. The structural fix is immutable / auto-updating base images.
Tooling options
Evidence shape
WAF enabled in blocking mode. Managed-rule subscription current. Custom rules version-controlled. Per-incident WAF-block review.
Notes
WAF in 'monitor' mode never moved to 'block' is the most common shelfware control.
Tooling options
Evidence shape
Quarterly board pack with technology / cyber / AI risk reporting. Action items tracked. Materiality threshold documented.
Notes
EU NIS2 explicit board accountability. APRA CPS 234 + CPS 230 board-level oversight. ISO 42001 top management responsibility.