SOC 2 Type II – Control Mapping

This page shows which Wombat controls cover which requirements of SOC 2 Type II.

Framework Control	Requirement	Wombat Controls	Severity	Pillar	Category
A1.2 – Failover and recovery	A1.2 – Failover and recovery	WAF-REL-130	🟠	Reliability	backup-recovery
C1.1 – Confidentiality	C1.1 – Confidentiality	WAF-SEC-060	🔴	Security	identity-access
C1.1 – Confidentiality of information	C1.1 – Confidentiality of information	WAF-SEC-030 · WAF-SEC-130	🟠	Security	identity-access
CC4.1 – Monitoring activities	CC4.1 – Monitoring activities	WAF-AGN-030 · WAF-AGN-040 · WAF-AGN-050 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-080 · WAF-AGN-090 · WAF-AGN-100 · WAF-SEC-090 · WAF-SEC-160	🟠 🟡 🟢	Agentic, Security	identity-access, logging-monitoring, reliability-design
CC6.1 – Logical access controls	CC6.1 – Logical access controls	WAF-AGN-110	🟠	Agentic	agentic-governance
CC6.1 – Logical access security	CC6.1 – Logical access security	WAF-AGN-020 · WAF-AGN-050 · WAF-AGN-080 · WAF-SEC-020 · WAF-SEC-030 · WAF-SEC-060	🔴 🟠	Agentic, Security	agentic-governance, identity-access, logging-monitoring
CC6.1 – Logical and physical access controls	CC6.1 – Logical and physical access controls	WAF-AGN-010 · WAF-SEC-010	🔴 🟠	Agentic, Security	identity-access
CC6.2 – Provisioning and removal of access	CC6.2 – Provisioning and removal of access	WAF-AGN-010 · WAF-SEC-010	🔴 🟠	Agentic, Security	identity-access
CC6.3 – Authentication mechanisms	CC6.3 – Authentication mechanisms	WAF-SEC-010	🔴	Security	identity-access
CC6.3 – Authorisation and segregation of duties	CC6.3 – Authorisation and segregation of duties	WAF-AGN-020 · WAF-SEC-020	🔴 🟠	Agentic, Security	agentic-governance, identity-access
CC6.3 – Role-based access control	CC6.3 – Role-based access control	WAF-SOV-060	🔴	Sovereign Cloud	identity-access
CC6.6 – Logical access	CC6.6 – Logical access	WAF-SOV-060	🔴	Sovereign Cloud	identity-access
CC6.6 – Network access boundaries	CC6.6 – Network access boundaries	WAF-SEC-050	🟠	Security	network-security
CC6.6 – Protection of data in transit	CC6.6 – Protection of data in transit	WAF-SEC-040	🟠	Security	identity-access
CC6.6 – Security infrastructure and software	CC6.6 – Security infrastructure and software	WAF-SEC-140	🟠	Security	network-security
CC6.6 – System hardening	CC6.6 – System hardening	WAF-SEC-120	🟠	Security	identity-access
CC7.1 – Detect and Monitor – Vulnerability and Threat Detection	CC7.1 – Detect and Monitor – Vulnerability and Threat Detection	WAF-OPS-030	🟠	Operational Excellence	logging-monitoring
CC7.1 – Infrastructure and software monitoring	CC7.1 – Infrastructure and software monitoring	WAF-AGN-030 · WAF-AGN-040 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-090 · WAF-AGN-100 · WAF-SEC-090	🟠 🟡 🟢	Agentic, Security	identity-access, logging-monitoring, reliability-design
CC7.1 – System monitoring	CC7.1 – System monitoring	WAF-SEC-120	🟠	Security	identity-access
CC7.1 – System monitoring – vulnerability detection	CC7.1 – System monitoring – vulnerability detection	WAF-SEC-070	🟡	Security	container-security
CC7.1 – Vulnerability detection	CC7.1 – Vulnerability detection	WAF-SEC-150	🟠	Security	container-security
CC7.2 – Evaluation of system changes	CC7.2 – Evaluation of system changes	WAF-SEC-090	🟡	Security	identity-access
CC7.2 – System anomaly detection	CC7.2 – System anomaly detection	WAF-SEC-080	🟠	Security	identity-access
CC7.2 – System monitoring	CC7.2 – System monitoring	WAF-SEC-140 · WAF-SEC-160	🟠	Security	logging-monitoring, network-security
CC7.4 – Detection and monitoring of security events	CC7.4 – Detection and monitoring of security events	WAF-SEC-080	🟠	Security	identity-access
CC7.4 – Detection of security events	CC7.4 – Detection of security events	WAF-SEC-100	🟡	Security	identity-access
CC7.4 – Security incident response	CC7.4 – Security incident response	WAF-SOV-070	🟠	Sovereign Cloud	identity-access
CC7.5 – Incident response	CC7.5 – Incident response	WAF-SEC-100	🟡	Security	identity-access
CC8.1 – Change Management – Authorized Changes	CC8.1 – Change Management – Authorized Changes	WAF-OPS-050 · WAF-OPS-090	🟠 🟡	Operational Excellence	deployment-automation, logging-monitoring
CC8.1 – Change management	CC8.1 – Change management	WAF-SEC-070	🟡	Security	container-security
CC9.1 – Risk Mitigation Activities	CC9.1 – Risk Mitigation Activities	WAF-OPS-060	🟡	Operational Excellence	identity-access
CC9.2 – Risk Assessment and Communication	CC9.2 – Risk Assessment and Communication	WAF-OPS-070	🟡	Operational Excellence	data-governance
CC9.2 – Vendor and business partner management	CC9.2 – Vendor and business partner management	WAF-SEC-110	🟠	Security	container-security
P1 – Privacy criteria	P1 – Privacy criteria	WAF-SEC-130	🟠	Security	identity-access

Framework Control

Requirement

Wombat Controls

Severity

Pillar

Category

A1.2 – Failover and recovery

WAF-REL-130

🟠

Reliability

backup-recovery

C1.1 – Confidentiality

WAF-SEC-060

🔴

Security

identity-access

C1.1 – Confidentiality of information

WAF-SEC-030 · WAF-SEC-130

🟠

Security

identity-access

CC4.1 – Monitoring activities

WAF-AGN-030 · WAF-AGN-040 · WAF-AGN-050 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-080 · WAF-AGN-090 · WAF-AGN-100 · WAF-SEC-090 · WAF-SEC-160

🟠 🟡 🟢

Agentic, Security

identity-access, logging-monitoring, reliability-design

CC6.1 – Logical access controls

WAF-AGN-110

🟠

Agentic

agentic-governance

CC6.1 – Logical access security

WAF-AGN-020 · WAF-AGN-050 · WAF-AGN-080 · WAF-SEC-020 · WAF-SEC-030 · WAF-SEC-060

🔴 🟠

Agentic, Security

agentic-governance, identity-access, logging-monitoring

CC6.1 – Logical and physical access controls

WAF-AGN-010 · WAF-SEC-010

🔴 🟠

Agentic, Security

identity-access

CC6.2 – Provisioning and removal of access

WAF-AGN-010 · WAF-SEC-010

🔴 🟠

Agentic, Security

identity-access

CC6.3 – Authentication mechanisms

WAF-SEC-010

🔴

Security

identity-access

CC6.3 – Authorisation and segregation of duties

WAF-AGN-020 · WAF-SEC-020

🔴 🟠

Agentic, Security

agentic-governance, identity-access

CC6.3 – Role-based access control

WAF-SOV-060

🔴

Sovereign Cloud

identity-access

CC6.6 – Logical access

WAF-SOV-060

🔴

Sovereign Cloud

identity-access

CC6.6 – Network access boundaries

WAF-SEC-050

🟠

Security

network-security

CC6.6 – Protection of data in transit

WAF-SEC-040

🟠

Security

identity-access

CC6.6 – Security infrastructure and software

WAF-SEC-140

🟠

Security

network-security

CC6.6 – System hardening

WAF-SEC-120

🟠

Security

identity-access

CC7.1 – Detect and Monitor – Vulnerability and Threat Detection

WAF-OPS-030

🟠

Operational Excellence

logging-monitoring

CC7.1 – Infrastructure and software monitoring

WAF-AGN-030 · WAF-AGN-040 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-090 · WAF-AGN-100 · WAF-SEC-090

🟠 🟡 🟢

Agentic, Security

identity-access, logging-monitoring, reliability-design

CC7.1 – System monitoring

WAF-SEC-120

🟠

Security

identity-access

CC7.1 – System monitoring – vulnerability detection

WAF-SEC-070

🟡

Security

container-security

CC7.1 – Vulnerability detection

WAF-SEC-150

🟠

Security

container-security

CC7.2 – Evaluation of system changes

WAF-SEC-090

🟡

Security

identity-access

CC7.2 – System anomaly detection

WAF-SEC-080

🟠

Security

identity-access

CC7.2 – System monitoring

WAF-SEC-140 · WAF-SEC-160

🟠

Security

logging-monitoring, network-security

CC7.4 – Detection and monitoring of security events

WAF-SEC-080

🟠

Security

identity-access

CC7.4 – Detection of security events

WAF-SEC-100

🟡

Security

identity-access

CC7.4 – Security incident response

WAF-SOV-070

🟠

Sovereign Cloud

identity-access

CC7.5 – Incident response

WAF-SEC-100

🟡

Security

identity-access

CC8.1 – Change Management – Authorized Changes

WAF-OPS-050 · WAF-OPS-090

🟠 🟡

Operational Excellence

deployment-automation, logging-monitoring

CC8.1 – Change management

WAF-SEC-070

🟡

Security

container-security

CC9.1 – Risk Mitigation Activities

WAF-OPS-060

🟡

Operational Excellence

identity-access

CC9.2 – Risk Assessment and Communication

WAF-OPS-070

🟡

Operational Excellence

data-governance

CC9.2 – Vendor and business partner management

WAF-SEC-110

🟠

Security

container-security

P1 – Privacy criteria

WAF-SEC-130

🟠

Security

identity-access

SOC 2 Type II – Control Mapping

See also