Does Azure Security Benchmark cover OCC Heightened Standards (12 CFR Part 30, Appendix D)?

38% of OCC Heightened Standards (12 CFR Part 30, Appendix D) you already have

Azure Security Benchmark already covers about 38% of OCC Heightened Standards (12 CFR Part 30, Appendix D), leaving 5 of 8 controls as genuinely new work.

Already covered 1 Likely covered 2 New work 5

What is genuinely new work

Nothing in Azure Security Benchmark reaches these. This is the list to scope.

OCCHS-2

Risk Governance Framework: Three Lines of Defense, Scope, and Charter

OCCHS-4

Independent Risk Management: CRO, Charter, Authority, and Oversight

OCCHS-5

Internal Audit: Independence, Scope, Methodology, and Reporting

OCCHS-6

Board of Directors: Composition, Independence, Oversight, and Self-Assessment

OCCHS-8

Third-Party Risk Within Heightened Standards and Integration with Broader Regulation

Show the 3 you already have

OCCHS-1

Scope, Applicability, and Definitions of Heightened Standards

OCCHS-3

Risk Appetite Statement, Risk Limits, Concentration Risk, and Limit Breach Protocols

OCCHS-7

Risk Data Aggregation, Reporting, Talent, Compensation, and Strategic Planning

How this is calculated

Already covered means a mapping runs from a control in Azure Security Benchmark to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair · Today's edition