Shipped Compliance Frameworks

UTMStack v12.0.2 ships nine compliance frameworks, all built on one shared library of 320 controls. This page describes what each framework covers, how much of it UTMStack can check from your logs, which log sources settle the automatic checks, and which part always needs a person's verdict. Use it to choose the frameworks you report on and to plan how to raise their scores.

For how controls, statuses and scores work, see Compliance Overview. For running and reading a report, see Compliance Reports.

The frameworks at a glance

• Controls used is how many distinct controls the framework's requirements point to. One control can answer several requirements.

• Automatic controls are judged from your logs and alerts. The other controls are manual (governance) controls: policies, training, contracts, physical security and settings that logs cannot show. They stay Out of scope until a person records a status, and they keep the score down until then.

• Without an Enterprise licence (the Community edition), only CMMC 2.0 and GDPR can be opened, evaluated and scheduled. See Compliance Overview and License and Editions.

The frameworks quote official requirement numbers. Where the standard is copyrighted (ISO/IEC 27001, PCI DSS, SOC 2), the requirement titles are short paraphrases and the official text is not reproduced; keep your own copy of the standard for an audit.

Each framework

Banking Security Audit

A security-log audit checklist for banks and other financial institutions. It covers what an internal or external auditor checks about log collection and retention, monitoring, real-time alerting, incident evidence, log protection and governance. It is a UTMStack checklist, built from the UTMStack v11 banking audit list and informed by FFIEC, Basel and SWIFT Customer Security Programme expectations; it is not a regulator's text.

It has the highest share of automatic controls (42 of 83), so it is the framework where your logs settle the most.

CMMC 2.0

The US Department of Defense Cybersecurity Maturity Model Certification (32 CFR Part 170). Level 1 is the 15 FAR 52.204-21 safeguarding requirements; Level 2 is the 110 NIST SP 800-171 Rev 2 requirements grouped by their 14 domains; Level 3 is 24 selected NIST SP 800-172 requirements. Available without an Enterprise licence.

GDPR — EU General Data Protection Regulation

The obligations of controllers and processors under Regulation (EU) 2016/679, from the processing principles to international transfers. Security of processing (Article 32) and breach handling (Articles 33 and 34) are checked from logs and alerts; the other obligations, such as lawful basis, data subject rights and the data protection officer, need a person to record their status. Available without an Enterprise licence.

Only 12 of its 50 controls are automatic, so expect a low score until someone records verdicts on the governance requirements.

HIPAA Security Rule

The administrative, physical and technical safeguards, organizational requirements and documentation requirements for electronic protected health information under 45 CFR Part 164 Subpart C, mapped with guidance from NIST SP 800-66 Rev 2. The technical safeguards (§164.312, such as audit controls, unique user identification and transmission security) are where the automatic checks help most.

ISO/IEC 27001:2022

ISO/IEC 27001:2022 with Amendment 1:2024: the information security management system (ISMS) requirements of clauses 4 to 10 and all 93 Annex A controls. Clauses 4 to 10 (context, leadership, planning, support, operation, evaluation, improvement) are management requirements and need verdicts. Most automatic checks sit under A.8 Technological controls.

NIST SP 800-171 Rev 3

The security requirements for protecting the confidentiality of Controlled Unclassified Information (CUI) in nonfederal systems and organizations (May 2024 edition). Withdrawn requirements are left out. Each requirement points to its source controls in NIST SP 800-53.

NIST Cybersecurity Framework 2.0

NIST CSF 2.0 (February 2024): 6 functions (Govern, Identify, Protect, Detect, Respond, Recover), 22 categories and 106 subcategories. Each section is a category and each requirement a subcategory, such as DE.CM-01. The Detect and Respond categories are where logs help most; Govern and Recover need verdicts.

PCI DSS v4.0.1

The Payment Card Industry Data Security Standard v4.0.1: every defined-approach requirement of the 12 principal requirements and Appendices A1 and A2, by official number. With 260 requirements it is the largest framework. Requirement 10 (log and monitor all access) and Requirement 8 (identify users and authenticate access) are where the automatic checks help most.

SOC 2 — Trust Services Criteria

The AICPA Trust Services Criteria (2017, with the 2022 revised points of focus): the common criteria CC1 to CC9 plus the Availability, Confidentiality, Processing Integrity and Privacy criteria. CC6 (logical and physical access) and CC7 (system operations) are where logs help most.

The 45 automatic controls

These are the shipped controls that UTMStack judges from your data. All of them use the strategy ANY: one passing evidence check is enough, but any failed limit check makes the control Non-compliant.

• Evidence checks pass when at least one matching record is found, for example "failed logons are recorded".

• Limit checks fail when more matching records than allowed are found, for example "an audit log was cleared".

Controls your team's work settles

Five checks read your alerts rather than your logs. They pass because of what your team does in UTMStack:

If no alert was raised in a quiet period, ir-5 cannot pass on its own; its remediation text says to set the status by hand and note why. See Alert Triage Workflow.

Which log sources settle the automatic checks

Almost every check reads one data type; eight read your alerts or logs of any type (last row of the table). A check whose data type your tenant did not send in the reporting window shows No data and neither passes nor fails. The more of these sources you connect, the more automatic controls can be judged.

Raise a framework's score

1. 1

   Connect the sources the checks read

   Run the framework once and open the PDF section Not evaluated — missing sources. It groups the controls that could not be judged by the log source that would settle them. Connect those sources. See How Data Reaches UTMStack.

2. 2

   Fix what failed

   On the report, open each Non-compliant control. Check results shows which check failed and how many records matched; the Remediation text says what the failure means. Fix the cause, then run the evaluation again. A failed limit check makes the control non-compliant until the window no longer contains the records, so the result clears only after the reporting window has moved past them.

3. 3

   Work your alerts

   Move alerts to In review and Completed as you work them, so the alert checks of au-6 and ir-4 pass.

4. 4

   Record verdicts on manual controls

   Every manual control stays Out of scope and counts against the score until a person records a status with a reason, for example where the policy document is kept. See Compliance Reports.

Not what you need?

You can copy any shipped framework and change the copy, or build your own framework and controls, for example for an internal policy or a customer's checklist. See Custom Frameworks and Controls.