Running container images should have no unresolved vulnerabilities

SOC 2

• CC3.2 COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed
• CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
• CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.

ISO/IEC 27001:2022

• A.5.21 Managing information security in the ICT supply chain
• A.8.9 Configuration management

NIS2 Directive (EU 2022/2555)

• 3 Incident handling
• 5 Supply chain security
• 6 Security in network and information systems acquisition, development and maintenance

RBI Cyber Security Framework for UCBs

• Annex I (6)

BSI C5:2025

• OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
• OPS-18.02B The cloud service provider mandates in its policies and procedures that 'critical' vulnerabilities are to be timely engaged with after identification of the critical vulnerability, even outside the working day.
• OPS-18.03B The cloud service provider also mandates in its policies and procedures that for 'high' vulnerabilities, engagement is to begin within one working day after identification, with regular follow-up of the vulnerability until it has been remediated.
• OPS-26.03B If non-modifiable ('immutable') images are used, compliance with the hardening specifications, as defined in the hardening requirements, is checked upon creation of the images.
• OPS-32.01B Guidelines and instructions with technical and organisational measures for the planning and management of containers are documented, communicated and provided in accordance with SP-01. These guidelines and instructions contain specifications for the entire container life cycle...

HIPAA Security Rule 2003

• 164.308(a)(5)(ii)(B): Administrative Safeguards