| Control | ISO 27001 | SOC 2 | Evidence source | Collected | Status |
|---|---|---|---|---|---|
| Access control policy | A.5.15 | CC6.1 | Policy library | Automatic | Met |
| Secure authentication | A.8.5 | CC6.1 | Identity sign-in reports | Automatic | Met |
| Vulnerability management | A.8.8 | CC7.1 | Priority and SLA reports | Automatic | Met |
| Use of cryptography | A.8.24 | CC6.7 | Key inventory, decrypt log | Automatic | Met |
| Logging and monitoring | A.8.15 | CC7.2 | Audit hash chain | Automatic | Met |
| Access reviews | A.5.18 | CC6.2 | Review campaigns | Manual upload | Gap |
| Supplier security | A.5.19 | CC9.2 | Third-party attestations | Manual upload | Gap |