What is a CIS Controls to SOC 2 mapping?

A CIS Controls to SOC 2 mapping (or crosswalk) shows which CIS Critical Security Controls satisfy which AICPA Trust Services Criteria. CIS publishes an official mapping document for CIS Controls v8.1 → SOC 2 TSC. The value is that you can implement a CIS Control once — say, restricting container privileges — and that single check satisfies requirements across multiple audit frameworks at once.

Do CIS Docker Benchmark checks count as SOC 2 evidence?

Yes. CIS Benchmarks are referenced by nearly every major compliance framework. Passing Docker Benchmark checks directly satisfies configuration-related requirements in SOC 2 CC6 (Logical and Physical Access Controls) and CC7 (System Operations). The evidence needs to be traceable and reproducible — a raw docker-bench-security pass/warn log is a start, but an audit-ready report with timestamps, control IDs, and remediation history is what auditors actually want.

What is 'assess once, report many' in compliance?

Assess once, report many means that a single security check can simultaneously satisfy controls across multiple frameworks — for example, a CIS Benchmark check that also satisfies a SOC 2 TSC requirement and an ISO 27001 Annex A control. Instead of running three separate audits with three separate evidence trails, you run one assessment and let the control mapping generate evidence for all three. This is the foundation of how Keelix maps its 93 deterministic checks.

How does Keelix generate compliance evidence?

Each Keelix check maps to one or more controls in CIS Controls v8.1, SOC 2 TSC, and ISO 27001:2022. When you run keelix scan, every finding includes the mapped control IDs. Keelix Cloud stores a timestamped scan record that serves as a point-in-time audit artefact — reproducible, shareable, and scoped to the specific host and configuration that was checked.

Compliance

Assess once. Satisfy many.

Each of Keelix's 93 deterministic checks maps to a control in CIS Controls v8.1, SOC 2 TSC, and ISO 27001:2022. Run the scan once, get a posture score, and generate audit-ready evidence for all three frameworks from the same pass.

Why three frameworks converge on the same checks

CIS Controls, SOC 2 Trust Services Criteria, and ISO 27001 Annex A are three different languages for the same underlying idea: that production systems should have known, hardened configurations, with traceable evidence that the hardening was applied. The vocabulary differs, but a surprisingly large number of the controls point at the same technical facts — container privilege settings, SSH key management, network exposure, secret handling.

The Center for Internet Security publishes official crosswalk documents mapping CIS Controls v8.1 to both SOC 2 TSC and ISO/IEC 27001:2022. The practical consequence: implementing CIS Safeguards covers a substantial portion of both SOC 2 and ISO 27001 requirements without any additional assessment work. That is the “assess once, report many” principle in practice.

What Keelix's checks map to

Every finding in a Keelix scan includes the relevant control IDs. Here is how the four check surfaces align to the frameworks.

HOST CONFIG

Host configuration hardening

SSH hardening, sudo restrictions, auto-updates, kernel parameter tuning. Each check maps to a specific CIS Safeguard and the corresponding SOC 2 and ISO controls it satisfies.

CIS Controls: IG1/IG2 Safeguards 4.1, 4.2, 4.5

SOC 2 TSC: CC6.1, CC6.6, CC6.7

ISO 27001: A.8.9, A.8.19

CONTAINERS

CIS Docker Benchmark

Non-root containers, dropped capabilities, no --privileged, seccomp/AppArmor, read-only root filesystems, resource limits. Each benchmark check is a direct CIS Benchmark item with its compliance cross-reference.

CIS Controls: IG1 Safeguards 4.1, 12.2

SOC 2 TSC: CC6.1, CC7.1

ISO 27001: A.8.25, A.8.29

INTERNET EXPOSURE

Outside-in exposure checks

Port bindings, 0.0.0.0 vs 127.0.0.1, Docker daemon API (2375/2376), Chrome DevTools Protocol (9222). Reachability from the internet, not just what the host firewall says.

CIS Controls: IG1 Safeguard 12.2

SOC 2 TSC: CC6.6, CC6.7

ISO 27001: A.8.20, A.8.21

AI / MCP POSTURE

AI-agent and MCP security

Auto-approval, plaintext secrets in MCP config, unvetted MCP servers, the lethal trifecta. The only surface no other compliance tool checks — and each finding still maps to a CIS/SOC 2/ISO control.

CIS Controls: IG2 Safeguards 3.11, 4.1

SOC 2 TSC: CC6.1, CC6.3

ISO 27001: A.8.3, A.8.6

The compliance gap in self-hosted Docker stacks

Tools like Vanta and Drata automate compliance evidence collection beautifully — for cloud-managed infrastructure. They poll AWS, GCP, Azure, and SaaS tools through official APIs. What they cannot see is a self-hosted VPS running Docker: the containers on it, the host configuration, the ports actually reachable from the internet, and the AI agents running alongside your production services.

That gap leaves a hole in your SOC 2 CC6 and CC7 evidence. The auditor wants evidence that the server itself was hardened and assessed — not just that your GitHub repositories have branch protection enabled. A Keelix scan closes that gap with a timestamped, control-mapped record of every check run against the live box.

The same applies to raw CLI tools. docker-bench-security emits a pass/warn log with no history, no control IDs for your audit trail, and no cross-framework mapping. Lynis runs a host audit but skips containers, MCP agents, and outside-in exposure. Keelix runs all four surfaces in one pass and outputs a structured report that maps each finding to the compliance frameworks it satisfies.

What a Keelix compliance record looks like

Each scan produces a structured report. In the terminal, that looks like a pass/warn/crit table. Exported as JSON or uploaded to Keelix Cloud, each finding includes:

Example — finding record (JSON)

{
  "check_id": "docker.container.no-root-user",
  "verdict": "CRIT",
  "title": "Container running as root",
  "remediation": "Add USER 1000 to your Dockerfile",
  "controls": {
    "cis_v8_1": ["IG1 Safeguard 4.1"],
    "soc2_tsc": ["CC6.1", "CC7.1"],
    "iso27001_2022": ["A.8.25"]
  },
  "scan_id": "kx_20260610T143200Z",
  "host": "prod-01.example.com"
}

Keelix Cloud stores every scan record with an immutable timestamp. When your auditor asks “was server prod-01 in a known configuration on [date]?” you share the scan record for that date — with the specific check IDs, control references, and verdicts. No manual evidence collection, no spreadsheet of screenshots.

The assess-once pipeline

The ideal compliance pipeline for a self-hosted Docker stack runs Keelix at every deploy-to-staging step, gates on the posture score, and uploads the scan record to Keelix Cloud. The Cloud logbook builds a continuous evidence trail automatically — no manual audit preparation, no evidence sprints before SOC 2 review season.

Example: GitHub Actions compliance gate

- name: Keelix compliance gate
  uses: jakelamon/keelix@v0.1.0
  with:
    threshold: 80
    fail-on: cis-critical,mcp-auto-approval

The exit code gates the merge. The scan record goes to the Cloud logbook. The auditor gets a link to the evidence trail. That is the whole workflow.

Frequently asked

What is a CIS Controls to SOC 2 mapping?: A CIS Controls to SOC 2 mapping (or crosswalk) shows which CIS Critical Security Controls satisfy which AICPA Trust Services Criteria. CIS publishes an official mapping document for CIS Controls v8.1 → SOC 2 TSC. The value is that you can implement a CIS Control once — say, restricting container privileges — and that single check satisfies requirements across multiple audit frameworks at once.
Do CIS Docker Benchmark checks count as SOC 2 evidence?: Yes. CIS Benchmarks are referenced by nearly every major compliance framework. Passing Docker Benchmark checks directly satisfies configuration-related requirements in SOC 2 CC6 (Logical and Physical Access Controls) and CC7 (System Operations). The evidence needs to be traceable and reproducible — a raw docker-bench-security pass/warn log is a start, but an audit-ready report with timestamps, control IDs, and remediation history is what auditors actually want.
What is 'assess once, report many' in compliance?: Assess once, report many means that a single security check can simultaneously satisfy controls across multiple frameworks — for example, a CIS Benchmark check that also satisfies a SOC 2 TSC requirement and an ISO 27001 Annex A control. Instead of running three separate audits with three separate evidence trails, you run one assessment and let the control mapping generate evidence for all three. This is the foundation of how Keelix maps its 93 deterministic checks.
How does Keelix generate compliance evidence?: Each Keelix check maps to one or more controls in CIS Controls v8.1, SOC 2 TSC, and ISO 27001:2022. When you run keelix scan, every finding includes the mapped control IDs. Keelix Cloud stores a timestamped scan record that serves as a point-in-time audit artefact — reproducible, shareable, and scoped to the specific host and configuration that was checked.

Get audit-ready evidence from your next scan.

Free CLI — Apache-2.0, local-first. Every finding ships with its CIS, SOC 2, and ISO 27001 control IDs. Nothing leaves your box.

operator@host — keelix

# install — free & open source (Apache-2.0)

$ curl -fsSL https://keelix.dev/install.sh | sh

$ keelix scan

Get started Pricing