Appearance
Control Mapping Matrix
Document ID: PLCY-FED-005
Version: 1.0
Effective Date: December 30, 2025
Last Review: December 30, 2025
Owner: Hop And Haul Team
CONFIDENTIAL
This document is CONFIDENTIAL and for internal use only. Do not distribute outside the organization.
1. Purpose
This document provides a comprehensive mapping between NIST 800-53 Rev 5 controls, SOC 2 Trust Service Criteria (TSC), and Hop And Haul policy documents. It serves as the authoritative cross-reference for federal compliance and audit activities.
2. NIST 800-53 to SOC 2 TSC Mapping
2.1 Access Control (AC) Family
| NIST Control | Control Name | SOC 2 TSC | Hop And Haul Policy | Status |
|---|---|---|---|---|
| AC-1 | Policy and Procedures | CC1.1, CC5.2 | PLCY-ACC-001, PLCY-NIST-AC-001 | Implemented |
| AC-2 | Account Management | CC6.1, CC6.2 | PLCY-ACC-001 | Implemented |
| AC-2(1) | Automated System Account Management | CC6.1 | PLCY-ACC-001 | Implemented |
| AC-2(2) | Automated Temporary Account Removal | CC6.1 | PLCY-SEC-001 (3.3) | Implemented |
| AC-2(3) | Disable Accounts | CC6.1 | PLCY-ACC-001 | Implemented |
| AC-2(4) | Automated Audit Actions | CC6.1, CC7.2 | PLCY-AUD-001 | Implemented |
| AC-3 | Access Enforcement | CC6.1, CC6.3 | PLCY-SEC-001 (3.1) | Implemented |
| AC-4 | Information Flow Enforcement | CC6.1 | PLCY-SEC-001 (5.1) | Implemented |
| AC-5 | Separation of Duties | CC5.1 | PLCY-ACC-001 | Implemented |
| AC-6 | Least Privilege | CC6.1, CC6.3 | PLCY-ACC-001 | Implemented |
| AC-6(1) | Authorize Access to Security Functions | CC6.3 | PLCY-ACC-001 | Implemented |
| AC-6(2) | Non-privileged Access for Non-security Functions | CC6.3 | PLCY-ACC-001 | Implemented |
| AC-6(5) | Privileged Accounts | CC6.1 | PLCY-ACC-001 | Implemented |
| AC-6(9) | Log Use of Privileged Functions | CC7.2 | PLCY-AUD-001 | Implemented |
| AC-6(10) | Prohibit Non-privileged Users from Executing Privileged Functions | CC6.3 | PLCY-ACC-001 | Implemented |
| AC-7 | Unsuccessful Logon Attempts | CC6.1 | PLCY-SEC-001 (7.2) | Implemented |
| AC-8 | System Use Notification | CC6.1 | PLCY-SEC-001 | Implemented |
| AC-11 | Device Lock | CC6.1 | PLCY-SEC-001 (3.4) | Implemented |
| AC-12 | Session Termination | CC6.1 | PLCY-SEC-001 (3.3) | Implemented |
| AC-14 | Permitted Actions Without Identification | CC6.1 | PLCY-SEC-001 | Implemented |
| AC-17 | Remote Access | CC6.1, CC6.6 | PLCY-SEC-001 (9) | Implemented |
| AC-17(1) | Monitoring and Control | CC6.6 | PLCY-SEC-001, PLCY-AUD-001 | Implemented |
| AC-17(2) | Protection of Confidentiality and Integrity | CC6.6, CC6.7 | PLCY-SEC-001 (4, 5) | Implemented |
| AC-18 | Wireless Access | CC6.6 | PLCY-SEC-001 | Planned |
| AC-19 | Access Control for Mobile Devices | CC6.1 | PLCY-SEC-001 (3.2) | Implemented |
| AC-20 | Use of External Systems | CC6.6 | PLCY-NIST-SA-001 | Planned |
2.2 Audit and Accountability (AU) Family
| NIST Control | Control Name | SOC 2 TSC | Hop And Haul Policy | Status |
|---|---|---|---|---|
| AU-1 | Policy and Procedures | CC1.1, CC7.2 | PLCY-AUD-001, PLCY-NIST-AU-001 | Implemented |
| AU-2 | Event Logging | CC7.2 | PLCY-AUD-001 | Implemented |
| AU-3 | Content of Audit Records | CC7.2 | PLCY-AUD-001 | Implemented |
| AU-3(1) | Additional Audit Information | CC7.2 | PLCY-AUD-001 | Implemented |
| AU-4 | Audit Log Storage Capacity | CC7.2 | PLCY-AUD-001 | Implemented |
| AU-5 | Response to Audit Logging Process Failures | CC7.2 | PLCY-AUD-001 | Implemented |
| AU-5(1) | Storage Capacity Warning | CC7.2 | PLCY-AUD-001 | Implemented |
| AU-6 | Audit Record Review, Analysis, and Reporting | CC7.2, CC7.3 | PLCY-CTL-001 | Implemented |
| AU-6(1) | Automated Process Integration | CC7.2 | PLCY-AUD-001 | Implemented |
| AU-6(3) | Correlate Audit Record Repositories | CC7.2 | PLCY-AUD-001 | Planned |
| AU-7 | Audit Record Reduction and Report Generation | CC7.2 | PLCY-AUD-001 | Implemented |
| AU-8 | Time Stamps | CC7.2 | PLCY-AUD-001 | Implemented |
| AU-8(1) | Synchronization with Authoritative Time Source | CC7.2 | PLCY-AUD-001 | Implemented |
| AU-9 | Protection of Audit Information | CC7.2 | PLCY-SEC-001 (7.3) | Implemented |
| AU-9(4) | Access by Subset of Privileged Users | CC7.2 | PLCY-AUD-001 | Implemented |
| AU-11 | Audit Record Retention | CC7.2 | PLCY-RET-001 | Implemented |
| AU-12 | Audit Record Generation | CC7.2 | PLCY-AUD-001 | Implemented |
2.3 Configuration Management (CM) Family
| NIST Control | Control Name | SOC 2 TSC | Hop And Haul Policy | Status |
|---|---|---|---|---|
| CM-1 | Policy and Procedures | CC1.1, CC8.1 | PLCY-SEC-001, PLCY-NIST-CMSI-001 | Implemented |
| CM-2 | Baseline Configuration | CC8.1 | PLCY-DRP-001 | Implemented |
| CM-2(2) | Automation Support for Accuracy and Currency | CC8.1 | PLCY-DRP-001 | Planned |
| CM-3 | Configuration Change Control | CC8.1 | PLCY-SEC-001 (8) | Implemented |
| CM-3(2) | Testing, Validation, and Documentation | CC8.1 | PLCY-SEC-001 (8.2) | Implemented |
| CM-4 | Impact Analysis | CC8.1 | PLCY-SEC-001 (8) | Implemented |
| CM-5 | Access Restrictions for Change | CC8.1 | PLCY-SEC-001 (8) | Implemented |
| CM-6 | Configuration Settings | CC8.1 | PLCY-DRP-001 | Implemented |
| CM-7 | Least Functionality | CC6.8 | PLCY-INF-001 | Implemented |
| CM-7(1) | Periodic Review | CC6.8 | PLCY-INF-001 | Implemented |
| CM-8 | System Component Inventory | CC8.1 | - | Gap |
| CM-10 | Software Usage Restrictions | CC8.1 | PLCY-SEC-001 | Implemented |
| CM-11 | User-installed Software | CC8.1 | PLCY-SEC-001 | Implemented |
2.4 Contingency Planning (CP) Family
| NIST Control | Control Name | SOC 2 TSC | Hop And Haul Policy | Status |
|---|---|---|---|---|
| CP-1 | Policy and Procedures | CC1.1, A1.2 | PLCY-DRP-001 | Implemented |
| CP-2 | Contingency Plan | A1.2 | PLCY-DRP-001 | Implemented |
| CP-2(1) | Coordinate with Related Plans | A1.2 | PLCY-DRP-001 | Implemented |
| CP-2(3) | Resume Mission Functions | A1.2 | PLCY-DRP-001 | Implemented |
| CP-3 | Contingency Training | A1.2 | PLCY-RSK-001 | Implemented |
| CP-4 | Contingency Plan Testing | A1.2, A1.3 | PLCY-RSK-001, PLCY-DRP-001 | Implemented |
| CP-4(1) | Coordinate with Related Plans | A1.3 | PLCY-DRP-001 | Implemented |
| CP-6 | Alternate Storage Site | A1.2 | PLCY-DRP-001 | Implemented |
| CP-7 | Alternate Processing Site | A1.2 | PLCY-DRP-001 | Implemented |
| CP-9 | System Backup | A1.2 | PLCY-DRP-001 | Implemented |
| CP-9(1) | Testing for Reliability and Integrity | A1.3 | PLCY-DRP-001 | Implemented |
| CP-10 | System Recovery and Reconstitution | A1.2 | PLCY-DRP-001 | Implemented |
| CP-10(2) | Transaction Recovery | A1.2 | PLCY-DRP-001 | Implemented |
2.5 Identification and Authentication (IA) Family
| NIST Control | Control Name | SOC 2 TSC | Hop And Haul Policy | Status |
|---|---|---|---|---|
| IA-1 | Policy and Procedures | CC1.1, CC6.1 | PLCY-SEC-001 | Implemented |
| IA-2 | Identification and Authentication | CC6.1 | PLCY-SEC-001 (3.2) | Implemented |
| IA-2(1) | Multi-factor Authentication to Privileged Accounts | CC6.1 | PLCY-SEC-001 (3.2) | Implemented |
| IA-2(2) | Multi-factor Authentication to Non-privileged Accounts | CC6.1 | PLCY-SEC-001 (3.2) | Implemented |
| IA-2(8) | Access to Accounts - Replay Resistant | CC6.1 | PLCY-SEC-001 (3.3) | Implemented |
| IA-2(12) | Acceptance of PIV Credentials | CC6.1 | - | Gap |
| IA-4 | Identifier Management | CC6.1 | PLCY-ACC-001 | Implemented |
| IA-5 | Authenticator Management | CC6.1 | PLCY-SEC-001 (3.2) | Implemented |
| IA-5(1) | Password-based Authentication | CC6.1 | PLCY-SEC-001 | Implemented |
| IA-5(2) | PKI-based Authentication | CC6.1 | PLCY-SEC-001 | Planned |
| IA-6 | Authenticator Feedback | CC6.1 | PLCY-SEC-001 | Implemented |
| IA-8 | Identification and Authentication (Non-organizational Users) | CC6.1 | PLCY-SEC-001 | Implemented |
| IA-11 | Re-authentication | CC6.1 | PLCY-SEC-001 (3.4) | Implemented |
2.6 Incident Response (IR) Family
| NIST Control | Control Name | SOC 2 TSC | Hop And Haul Policy | Status |
|---|---|---|---|---|
| IR-1 | Policy and Procedures | CC1.1, CC7.3 | PLCY-INC-001, PLCY-NIST-IR-001 | Implemented |
| IR-2 | Incident Response Training | CC7.3 | PLCY-RSK-001 | Implemented |
| IR-3 | Incident Response Testing | CC7.3, CC7.4 | PLCY-RSK-001 | Implemented |
| IR-4 | Incident Handling | CC7.3, CC7.4 | PLCY-INC-001 | Implemented |
| IR-4(1) | Automated Incident Handling Processes | CC7.3 | PLCY-INC-001 | Implemented |
| IR-5 | Incident Monitoring | CC7.3 | PLCY-INC-001 | Implemented |
| IR-6 | Incident Reporting | CC7.3, CC7.4 | PLCY-INC-001 | Implemented |
| IR-6(1) | Automated Reporting | CC7.3 | PLCY-INC-001 | Planned |
| IR-7 | Incident Response Assistance | CC7.3 | PLCY-INC-001 | Implemented |
| IR-8 | Incident Response Plan | CC7.3 | PLCY-INC-001 | Implemented |
2.7 Risk Assessment (RA) Family
| NIST Control | Control Name | SOC 2 TSC | Hop And Haul Policy | Status |
|---|---|---|---|---|
| RA-1 | Policy and Procedures | CC1.1, CC3.1 | PLCY-RSK-001 | Implemented |
| RA-2 | Security Categorization | CC3.1 | PLCY-FED-002 | Implemented |
| RA-3 | Risk Assessment | CC3.2 | PLCY-RSK-001, PLCY-FED-003 | Implemented |
| RA-3(1) | Supply Chain Risk Assessment | CC3.2 | PLCY-NIST-SA-001 | Planned |
| RA-5 | Vulnerability Monitoring and Scanning | CC7.1 | PLCY-SEC-001 (6) | Implemented |
| RA-5(2) | Update Vulnerabilities to Be Scanned | CC7.1 | PLCY-SEC-001 (6.1) | Implemented |
| RA-5(5) | Privileged Access | CC7.1 | PLCY-SEC-001 | Implemented |
| RA-7 | Risk Response | CC3.2 | PLCY-RSK-001 | Implemented |
| RA-9 | Criticality Analysis | CC3.2 | PLCY-RSK-001 | Implemented |
2.8 System and Communications Protection (SC) Family
| NIST Control | Control Name | SOC 2 TSC | Hop And Haul Policy | Status |
|---|---|---|---|---|
| SC-1 | Policy and Procedures | CC1.1, CC6.6 | PLCY-SEC-001 | Implemented |
| SC-4 | Information in Shared System Resources | CC6.1 | PLCY-SEC-001 (3.1) | Implemented |
| SC-5 | Denial-of-service Protection | A1.2 | PLCY-SEC-001 (9) | Implemented |
| SC-7 | Boundary Protection | CC6.6 | PLCY-SEC-001 (9) | Implemented |
| SC-7(4) | External Telecommunications Services | CC6.6 | PLCY-SEC-001 | Implemented |
| SC-7(5) | Deny by Default | CC6.6 | PLCY-SEC-001 | Implemented |
| SC-8 | Transmission Confidentiality and Integrity | CC6.6, CC6.7 | PLCY-SEC-001 (4.2) | Implemented |
| SC-8(1) | Cryptographic Protection | CC6.6 | PLCY-SEC-001 (4.2) | Implemented |
| SC-10 | Network Disconnect | CC6.1 | PLCY-SEC-001 (3.3) | Implemented |
| SC-12 | Cryptographic Key Establishment and Management | CC6.6 | PLCY-SEC-001 (4.3) | Implemented |
| SC-13 | Cryptographic Protection | CC6.6 | PLCY-SEC-001 (4) | Partial (Gap: FIPS 140-2) |
| SC-15 | Collaborative Computing Devices | CC6.1 | PLCY-SEC-001 | Implemented |
| SC-17 | Public Key Infrastructure Certificates | CC6.6 | PLCY-SEC-001 | Implemented |
| SC-20 | Secure Name/Address Resolution Service | CC6.6 | PLCY-SEC-001 | Implemented |
| SC-21 | Secure Name/Address Resolution Service (Recursive) | CC6.6 | PLCY-SEC-001 | Implemented |
| SC-22 | Architecture and Provisioning for Name/Address | CC6.6 | PLCY-SEC-001 | Implemented |
| SC-23 | Session Authenticity | CC6.1 | PLCY-SEC-001 (3.3) | Implemented |
| SC-28 | Protection of Information at Rest | CC6.1, C1.1 | PLCY-SEC-001 (4.1) | Implemented |
| SC-28(1) | Cryptographic Protection | CC6.1 | PLCY-SEC-001 (4.1) | Implemented |
2.9 System and Information Integrity (SI) Family
| NIST Control | Control Name | SOC 2 TSC | Hop And Haul Policy | Status |
|---|---|---|---|---|
| SI-1 | Policy and Procedures | CC1.1, CC7.1 | PLCY-SEC-001, PLCY-NIST-CMSI-001 | Implemented |
| SI-2 | Flaw Remediation | CC7.1 | PLCY-SEC-001 (6) | Implemented |
| SI-2(2) | Automated Flaw Remediation Status | CC7.1 | PLCY-SEC-001 (6.2) | Implemented |
| SI-3 | Malicious Code Protection | CC7.1 | PLCY-SEC-001 | Implemented |
| SI-4 | System Monitoring | CC7.2 | PLCY-SEC-001 (7) | Implemented |
| SI-4(2) | Automated Tools and Mechanisms | CC7.2 | PLCY-SEC-001 (7) | Implemented |
| SI-4(4) | Inbound and Outbound Communications Traffic | CC7.2 | PLCY-SEC-001 | Implemented |
| SI-4(5) | System-generated Alerts | CC7.2 | PLCY-SEC-001 (7.2) | Implemented |
| SI-5 | Security Alerts, Advisories, and Directives | CC7.1 | PLCY-INC-001 | Implemented |
| SI-7 | Software, Firmware, and Information Integrity | CC8.1 | - | Gap |
| SI-10 | Information Input Validation | PI1.1 | PLCY-SEC-001 (5.2) | Implemented |
| SI-11 | Error Handling | PI1.1 | PLCY-SEC-001 | Implemented |
| SI-12 | Information Management and Retention | C1.2, PI1.5 | PLCY-RET-001 | Implemented |
| SI-16 | Memory Protection | CC7.1 | PLCY-SEC-001 | Implemented |
3. FedRAMP Moderate Baseline Coverage Summary
3.1 Coverage by Control Family
| Family | Total Required | Implemented | Planned | Gap | % Complete |
|---|---|---|---|---|---|
| AC (Access Control) | 25 | 20 | 3 | 2 | 80% |
| AT (Awareness & Training) | 6 | 4 | 2 | 0 | 67% |
| AU (Audit & Accountability) | 16 | 15 | 1 | 0 | 94% |
| CA (Assessment & Authorization) | 9 | 5 | 4 | 0 | 56% |
| CM (Configuration Management) | 11 | 9 | 1 | 1 | 82% |
| CP (Contingency Planning) | 13 | 12 | 1 | 0 | 92% |
| IA (Identification & Authentication) | 12 | 10 | 1 | 1 | 83% |
| IR (Incident Response) | 10 | 9 | 1 | 0 | 90% |
| MA (Maintenance) | 6 | 4 | 2 | 0 | 67% |
| MP (Media Protection) | 8 | 6 | 2 | 0 | 75% |
| PE (Physical & Environmental) | 20 | Inherited | - | - | 100% |
| PL (Planning) | 9 | 7 | 2 | 0 | 78% |
| PM (Program Management) | 16 | 12 | 4 | 0 | 75% |
| PS (Personnel Security) | 9 | Inherited | - | - | 100% |
| RA (Risk Assessment) | 9 | 8 | 1 | 0 | 89% |
| SA (System & Services Acquisition) | 22 | 14 | 6 | 2 | 64% |
| SC (System & Communications) | 41 | 32 | 7 | 2 | 78% |
| SI (System & Information Integrity) | 23 | 18 | 4 | 1 | 78% |
| SR (Supply Chain Risk) | 12 | 7 | 4 | 1 | 58% |
| TOTAL | ~325 | ~220 | ~90 | ~15 | ~68% |
3.2 Gap Summary
| Gap ID | Control | Description | Remediation Phase |
|---|---|---|---|
| GAP-01 | SC-13 | FIPS 140-2 validated cryptographic modules | Phase 3 |
| GAP-02 | IA-2(12) | PIV/CAC authentication | Phase 3 |
| GAP-03 | CM-8 | Automated component inventory | Phase 2 |
| GAP-04 | SI-7 | Software/firmware integrity verification | Phase 3 |
| GAP-05 | SA-4 | Formal acquisition security requirements | Phase 2 |
| GAP-06 | AC-18 | Wireless access controls | Phase 2 |
| GAP-07 | AC-20 | External system use policy | Phase 2 |
| GAP-08 | SA-9 | External system services assessment | Phase 2 |
| GAP-09 | SR-3 | Supply chain controls and processes | Phase 3 |
4. SOC 2 TSC to NIST 800-53 Reverse Mapping
4.1 Common Criteria (CC) to NIST
| SOC 2 Criteria | Description | NIST 800-53 Controls |
|---|---|---|
| CC1.1 | Control Environment | AC-1, AT-1, AU-1, CA-1, CM-1, CP-1, IA-1, IR-1, MA-1, MP-1, PE-1, PL-1, PM-1, PS-1, RA-1, SA-1, SC-1, SI-1 |
| CC2.1 | Information and Communication | PL-4, PS-6, SA-5 |
| CC3.1 | Risk Assessment | RA-1, RA-2, RA-3 |
| CC3.2 | Risk Mitigation | RA-3, RA-7 |
| CC5.1 | Control Activities | AC-5 |
| CC5.2 | Policies and Procedures | All -1 controls |
| CC6.1 | Logical Access | AC-2, AC-3, AC-5, AC-6, AC-7, AC-11, AC-12, IA-2, IA-4, IA-5, SC-4, SC-28 |
| CC6.2 | Access Authorization | AC-2 |
| CC6.3 | Access Enforcement | AC-3, AC-6 |
| CC6.6 | External Threats | AC-17, SC-7, SC-8, SC-12, SC-13 |
| CC6.7 | Transmission Protection | SC-8 |
| CC6.8 | Malicious Software | CM-7, SI-3 |
| CC7.1 | Vulnerability Management | RA-5, SI-2 |
| CC7.2 | System Monitoring | AU-2, AU-3, AU-6, AU-7, AU-9, AU-12, SI-4 |
| CC7.3 | Incident Response | IR-4, IR-5, IR-6, IR-7, IR-8 |
| CC7.4 | Incident Recovery | IR-4, IR-6 |
| CC8.1 | Change Management | CM-2, CM-3, CM-4, CM-5, CM-6, CM-8 |
4.2 Availability (A1) to NIST
| SOC 2 Criteria | Description | NIST 800-53 Controls |
|---|---|---|
| A1.1 | Capacity Management | CP-2, SC-5 |
| A1.2 | Recovery Operations | CP-2, CP-6, CP-7, CP-9, CP-10 |
| A1.3 | Recovery Testing | CP-4 |
4.3 Confidentiality (C1) to NIST
| SOC 2 Criteria | Description | NIST 800-53 Controls |
|---|---|---|
| C1.1 | Data Protection | SC-28 |
| C1.2 | Data Disposal | MP-6, SI-12 |
4.4 Processing Integrity (PI1) to NIST
| SOC 2 Criteria | Description | NIST 800-53 Controls |
|---|---|---|
| PI1.1 | Input Validation | SI-10 |
| PI1.2 | Processing Accuracy | SI-10 |
| PI1.3 | Output Review | SI-10 |
| PI1.5 | Data Retention | SI-12 |
5. Document References
| Document ID | Title | Controls Mapped |
|---|---|---|
| PLCY-SEC-001 | Security Controls | AC, SC, CM, SI |
| PLCY-ACC-001 | Access Control Matrix | AC |
| PLCY-AUD-001 | Audit Trail Specs | AU |
| PLCY-INC-001 | Incident Response | IR |
| PLCY-DRP-001 | Disaster Recovery | CP, CM |
| PLCY-RSK-001 | Risk Assessment | RA, PM |
| PLCY-RET-001 | Records Retention | AU-11, SI-12 |
| PLCY-INF-001 | Infrastructure Sizing | CM-7 |
| PLCY-CTL-001 | Control Testing | CA, AU-6 |
6. Document Control
| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | December 30, 2025 | Hop And Haul Team | Initial release |