Continuous validation identifies insecure settings before they become exploitable weaknesses.
Check systems against approved baselines, record deviations, risk-rank them, and route them into remediation or exception workflows.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.5 – Monitor, Evaluate and Assess (MEA) > MEA02 – Managed System of Internal Control > MEA02.02 – Review effectiveness of business process controls. 4.3 – Build, Acquire and Implement (BAI) > BAI10 – Managed Configuration > BAI10.02 – Establish and maintain a configuration repository and baseline. |
COBIT
Governance Framework
|
v2019 | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 9(2) – ICT security policies, procedures, protocols and tools for resilience and data security |
EU
Regulation
|
vCurrent | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 32(1)(d) – Testing, assessing and evaluating security measures; Article 32(1) – Security of processing |
EU
Regulation
|
vCurrent | View → |
| HIPAA | Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.312(c) Standard: Configuration management |
US
Law
|
vCurrent | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.9-3.3 – Change life cycle |
India
Guideline
|
vLatest | View → |
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 9.1 – Monitoring, measurement, analysis and evaluation |
ISO
Standard
|
v2022 | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 8.9 – Configuration management |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(f) – Policies and procedures to assess the effectiveness of cybersecurity risk-management measures |
EU
Directive
|
vCurrent | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: PR.PS – Platform Security | PR.PS-01 – Configuration management practices are established and applied |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.5 – CONFIGURATION MANAGEMENT; CM-3 – CONFIGURATION CHANGE CONTROL, CM-6 – CONFIGURATION SETTINGS |
NIST
Control Catalog
|
vRev. 5 | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 2.2.1 – Configuration standards are developed,; 2.2.6 – System security parameters are configured to |
PCI
Standard
|
v4 | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 5) Secure Configuration – 5.1 Baseline security requirements/configurations across device categories and lifecycle, with periodic review |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 3.4 PR.IP: Information Protection Processes and Procedures |
India
Regulation
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC5.2 – Control Activities – COSO Principle 11: The entity also selects and develops general control activities over technology to support the achievement of objectives. CC7.2 – System Operations – The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events. |
AICPA
Audit Framework
|
vLatest | View → |