Projects should have container vulnerability scanning enabled

SOC 2

• CC3.2 COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed

PCI DSS v4.0

• 11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
• 11.3.1.2: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
• 11.3.1.3: 3 Internal vulnerability scans are performed after any significant change

NIS2 Directive (EU 2022/2555)

• 2 Risk management policy
• 5 Supply chain security
• 6 Security in network and information systems acquisition, development and maintenance

NIST Cybersecurity Framework v2.0

• ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded.
• ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established.
• ID.RA-09
• PR.PS-06

BSI C5:2025

• OPS-25.01B System components in the area of responsibility of the cloud service provider for the provision of the cloud service are subject to vulnerability scans at least once a month in accordance with the policies for handling vulnerabilities (cf. OPS-18). These vulnerability scans include a...
• PSS-11.01AC At startup and runtime of virtual machine or container images, an integrity check is performed that detects image manipulations and reports them to the cloud service customer.
• PSS-11.01B If cloud service customers operate virtual machines or containers with the cloud service, the cloud service provider ensures the following aspects: - Cloud service customers can restrict the selection of images of virtual machines or containers according to their specifications, so...