> For the complete documentation index, see [llms.txt](https://wiki.datadike.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.datadike.com/pam/reference/compliance-mappings.md). # Compliance mappings Every control each compliance package answers, and which operational report the package embeds as the evidence for it. ## What this page is Each of the seven compliance packages in [Reports](/pam/administration/audit/reports.md) opens with a control map: a table that pairs a framework control with the operational report that evidences it. The package then embeds those operational reports in full, in the same file. This page is that map, for all seven packages, so you can answer two questions without generating anything: * **Which controls does this package cover?** Read the framework's table below. * **Where does a control's evidence come from?** The right-hand column names the operational report, and [Reports](/pam/administration/audit/reports.md#operational-reports) says what that report contains. {% hint style="warning" %} This is a mapping of platform evidence to control identifiers. It is not an assessment, a score, or a certification, and the coverage below is not a claim that the control is satisfied — only that the platform produces records relevant to it. Controls a PAM cannot reach, such as network segmentation or physical security, are absent by nature. {% endhint %} Two operational reports are not cited by any package: **File transfer** and **Automation runs**. Generate those separately when an assessor asks for them. ## PCI-DSS v4.0 Eight controls, five reports. | Control | What it covers | Evidence report | | ------- | --------------------------------- | ------------------------- | | 8.2 | Unique user identification | Access and authentication | | 8.3 | Strong authentication and MFA | Access and authentication | | 7.2 | Access on a need-to-know basis | Credential retrieval | | 8.6 | System and application accounts | Credential retrieval | | 7.2.5 | Controlled privileged access | Session activity | | 10.2 | Access audit trails | Session activity | | 8.3.9 | Periodic credential rotation | Password rotation | | 10.2.1 | Logging of administrative actions | Configuration trail | ## SOC 2, Trust Services Criteria Seven criteria, five reports. | Criterion | What it covers | Evidence report | | --------- | -------------------------------------- | --------------------------- | | CC6.1 | Logical access controls | Access and authentication | | CC6.6 | Authentication | Access and authentication | | CC6.3 | Privileged access | Session activity | | CC7.2 | Activity monitoring | Session activity | | CC6.2 | Access provisioning and deprovisioning | Account and vault inventory | | CC7.3 | Security event trail | Configuration trail | | CC6.3 | Access approval, JIT | Approvals and JIT access | ## HIPAA Security Rule Five controls, four reports. | Control | What it covers | Evidence report | | ---------------- | ------------------------------------- | --------------------------- | | 164.308(a)(4) | Information access management | Account and vault inventory | | 164.312(a)(2)(i) | Unique user identification | Access and authentication | | 164.312(d) | Person or entity authentication | Access and authentication | | 164.312(b) | Audit controls | Session activity | | 164.312(b) | Recording and examination of activity | Configuration trail | ## ISO/IEC 27001:2022 Seven controls, five reports. The identifiers follow the 2022 Annex A. | Control | What it covers | Evidence report | | ------- | ------------------------------------ | --------------------------- | | A.5.15 | Access control | Account and vault inventory | | A.5.18 | Access rights | Account and vault inventory | | A.5.17 | Authentication information | Credential retrieval | | A.5.17 | Management of authentication secrets | Password rotation | | A.8.2 | Privileged access rights | Session activity | | A.8.15 | Logging | Session activity | | A.8.15 | Event logging | Configuration trail | ## LGPD, Lei 13.709/2018 Five articles, four reports. | Article | What it covers | Evidence report | | ------- | ------------------------------- | ------------------------- | | Art. 46 | Security measures on access | Access and authentication | | Art. 46 | Access control over data | Credential retrieval | | Art. 37 | Record of processing operations | Session activity | | Art. 37 | Record of operations | Configuration trail | | Art. 46 | Traceability | Configuration trail | ## NIST SP 800-53 Rev.5 Sixteen controls, eight reports. The widest of the seven packages. | Control | What it covers | Evidence report | | ------- | ------------------------------------------ | --------------------------- | | AC-2 | Account management | Account and vault inventory | | AC-2(3) | Disable inactive accounts | Account and vault inventory | | IA-2 | Identification and authentication of users | Access and authentication | | IA-2(1) | MFA for privileged access | Access and authentication | | AC-7 | Unsuccessful logon attempts | Access and authentication | | AC-6 | Least privilege | Credential retrieval | | IA-5 | Authenticator management | Credential retrieval | | AC-6(9) | Logging the use of privileged functions | Session activity | | AU-14 | Session audit | Session activity | | AU-6 | Audit record review and analysis | Commands and violations | | SI-4 | System monitoring | Commands and violations | | IA-5(1) | Password-based authentication | Password rotation | | AU-2 | Event logging | Configuration trail | | AU-12 | Audit record generation | Configuration trail | | AC-3 | Access enforcement | Approvals and JIT access | | AC-2 | Access approval and provisioning | Approvals and JIT access | ## CIS Controls v8 Twelve safeguards, eight reports. | Safeguard | What it covers | Evidence report | | --------- | ----------------------------------------------- | --------------------------- | | 5.1 | Account inventory | Account and vault inventory | | 5.3 | Disable dormant accounts | Account and vault inventory | | 6.3 | MFA for externally exposed applications | Access and authentication | | 6.5 | MFA for administrative access | Access and authentication | | 5.4 | Restrict admin privileges to dedicated accounts | Credential retrieval | | 6.8 | Role-based access control | Credential retrieval | | 8.5 | Collect detailed audit logs | Session activity | | 8.11 | Audit log review | Commands and violations | | 5.2 | Use unique and strong passwords | Password rotation | | 8.2 | Collect audit logs | Configuration trail | | 6.1 | Access granting process | Approvals and JIT access | | 6.2 | Access revocation process | Approvals and JIT access | ## Which report answers the most controls Read the other way round, so you know which report to reach for when a control is questioned. Across the seven packages the maps cite sixty controls in all: | Operational report | Controls it evidences, across all seven packages | | --------------------------- | ------------------------------------------------ | | Access and authentication | 12 | | Session activity | 11 | | Configuration trail | 9 | | Credential retrieval | 8 | | Account and vault inventory | 8 | | Approvals and JIT access | 5 | | Password rotation | 4 | | Commands and violations | 3 | | File transfer | 0 | | Automation runs | 0 | {% hint style="info" %} The report names above are the English names used throughout this wiki. The generated file labels its sections in Portuguese whatever the console language is, so **Access and authentication** appears in the file as `== Acessos & Autenticação ==`. See the known limitations in [Reports](/pam/administration/audit/reports.md#known-limitations). {% endhint %} ## Related pages * [Reports](/pam/administration/audit/reports.md) — generating these packages, and what each operational report contains * [Audit trail](/pam/administration/audit/audit-trail.md) — the records underneath every one of them * [Configuration fields](/pam/reference/configuration-fields.md) — the retention settings that bound how far back a report can reach