Kubernetes clusters should have public access restrictions configured

SOC 2

• CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives

PCI DSS v4.0

• 1.2.8: Network security controls (NSCs) are configured and maintained.
• 1.3.1: Network access to and from the cardholder data environment is restricted.
• 1.3.2: Network access to and from the cardholder data environment is restricted.
• 1.4.2: Network connections between trusted and untrusted networks are controlled.
• 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks

NIS2 Directive (EU 2022/2555)

• 2 Risk management policy

RBI Cyber Security Framework for UCBs

• Annex I (1.3)

BSI C5:2025

• IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
• IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
• PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.

HIPAA Security Rule 2003

• 164.308(a)(1)(ii)(B) Risk management
• 164.312(a)(1) Access control