Best Practices & Mitigations Library
OMNI-GRC includes a comprehensive library of 55 security best practices and mitigations mapped to multiple compliance frameworks. This document provides detailed information about each mitigation, its cross-framework mappings, and implementation guidance.
Table of Contents
Overview
What is the Mitigations Library?
The Mitigations Library is a curated collection of security best practices that:
- Map to multiple frameworks - Each mitigation includes references to SOC 2, ISO 27001, HIPAA, PCI-DSS, NIST CSF, GDPR, and other standards
- Apply across industries - Tagged for Healthcare, Finance, Government, Technology, and more
- Include implementation guidance - Step-by-step instructions for implementation
- Specify evidence requirements - What auditors will want to see
- Indicate automation level - Full, partial, or manual implementation
Importance Levels
| Level |
Description |
| MANDATORY |
Required for baseline compliance across most frameworks |
| PREFERRED |
Strongly recommended; expected by most auditors |
| ADVANCED |
Best practice for mature security programs |
| OPTIONAL |
Nice-to-have; enhances security posture |
Automation Levels
| Level |
Description |
| Full |
Can be fully automated with security tools |
| Partial |
Some aspects automated, some manual |
| Manual |
Requires human review and action |
Identity & Access Management
IAM-001: Enforce Single Sign-On (SSO)
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Full |
| Industries |
All |
Description: Centralize authentication across your organization with SSO to minimize unauthorized access risk. SSO enhances security by enabling better control over account access, enforcing consistent security policies (e.g., MFA), and making it easier to revoke access when someone leaves.
Framework Mappings:
- SOC 2: CC6.1, CC6.8
- ISO 27001: A.5.16, A.5.17
- HIPAA: 164.312(d)
- PCI-DSS: 8.3
- NIST CSF: PR.AC-1
Implementation Guidance:
- Configure SSO with your identity provider (Okta, Azure AD, Google Workspace)
- Ensure all critical applications are integrated
- Enable MFA for SSO login
- Configure session timeout policies
Evidence Required:
- SSO configuration screenshots
- List of integrated applications
- MFA enforcement policy
IAM-002: Enable Multi-Factor Authentication (MFA)
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Full |
| Industries |
All |
Description: Require MFA for all critical services and administrative access. If someone has access to your password, they still cannot log into your account without the second factor.
Framework Mappings:
- SOC 2: CC6.1, CC6.8
- ISO 27001: A.8.5
- HIPAA: 164.312(d)
- PCI-DSS: 8.4
- NIST CSF: PR.AC-7
- GDPR: Art.32
Implementation Guidance:
- Enable MFA on all systems containing sensitive data
- Prioritize: Production systems, Identity providers, Cloud consoles, Code repositories
- Use hardware tokens or authenticator apps (avoid SMS when possible)
- Establish recovery procedures for lost MFA devices
Evidence Required:
- MFA policy
- MFA enrollment reports
- List of MFA-protected systems
IAM-003: Implement Role-Based Access Control (RBAC)
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Partial |
| Industries |
All |
Description: Follow the principle of least privilege - access should be limited to what is necessary for job duties. Define roles and their access levels for each system.
Framework Mappings:
- SOC 2: CC6.1, CC6.2
- ISO 27001: A.8.2, A.8.4
- HIPAA: 164.312(a)(1)
- PCI-DSS: 7.1
- NIST CSF: PR.AC-4
Implementation Guidance:
- Create a role matrix mapping job functions to access levels
- Review and approve access based on roles, not individuals
- Implement just-in-time (JIT) access for privileged operations
- Document role definitions and approval workflows
Evidence Required:
- Role matrix document
- Access approval workflow
- Periodic access review reports
IAM-004: Conduct Quarterly Access Reviews
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Partial |
| Industries |
All |
Description: Regularly review user access to ensure it remains appropriate. Remove access for terminated employees and adjust access for role changes.
Framework Mappings:
- SOC 2: CC6.2, CC6.3
- ISO 27001: A.5.18
- HIPAA: 164.308(a)(4)
- PCI-DSS: 7.2
- NIST CSF: PR.AC-1
Implementation Guidance:
- Schedule quarterly reviews for all systems
- Manager certifies access for their team members
- Privileged access reviewed by security team
- Document remediation for inappropriate access
Evidence Required:
- Access review schedule
- Completed review certifications
- Remediation tracking
IAM-005: Implement Privileged Access Management (PAM)
| Attribute |
Value |
| Importance |
PREFERRED |
| Automation |
Full |
| Industries |
All |
Description: Manage and monitor privileged accounts with elevated access to critical systems.
Framework Mappings:
- SOC 2: CC6.1
- ISO 27001: A.8.2
- PCI-DSS: 7.3
- NIST CSF: PR.AC-4
Implementation Guidance:
- Implement PAM solution (CyberArk, BeyondTrust, HashiCorp Vault)
- Rotate privileged credentials automatically
- Record privileged sessions
- Implement break-glass procedures for emergencies
Evidence Required:
- PAM solution configuration
- Credential rotation logs
- Session recordings (sample)
Data Protection & Privacy
DP-001: Encrypt Data at Rest
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Full |
| Industries |
All |
Description: Encrypt all sensitive data stored in databases, file systems, and backups using industry-standard encryption algorithms (AES-256).
Framework Mappings:
- SOC 2: CC6.7
- ISO 27001: A.8.24
- HIPAA: 164.312(a)(2)(iv)
- PCI-DSS: 3.4
- GDPR: Art.32
- NIST CSF: PR.DS-1
Implementation Guidance:
- Enable encryption at the database level
- Use encrypted file systems or disk encryption
- Encrypt backups before storage
- Manage encryption keys securely (separate from data)
Evidence Required:
- Encryption configuration screenshots
- Key management policy
- Encryption verification reports
DP-002: Encrypt Data in Transit
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Full |
| Industries |
All |
Description: Use TLS 1.2+ for all data transmitted over networks. Disable older protocols (SSL, TLS 1.0, TLS 1.1).
Framework Mappings:
- SOC 2: CC6.7
- ISO 27001: A.8.24
- HIPAA: 164.312(e)(1)
- PCI-DSS: 4.1
- GDPR: Art.32
- NIST CSF: PR.DS-2
Implementation Guidance:
- Configure TLS 1.2+ on all services
- Use strong cipher suites (disable weak ciphers)
- Implement HSTS for web applications
- Use certificate automation (Let’s Encrypt, internal CA)
Evidence Required:
- TLS configuration
- SSL Labs scan results
- Certificate inventory
DP-003: Implement Data Classification
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Partial |
| Industries |
All |
Description: Classify data based on sensitivity levels and apply appropriate controls.
Framework Mappings:
- SOC 2: CC6.7
- ISO 27001: A.5.12, A.5.13
- HIPAA: 164.312(a)(1)
- PCI-DSS: 9.6
- GDPR: Art.30
Classification Levels:
- Public - No restrictions
- Internal - Company use only
- Confidential - Need-to-know basis
- Restricted - Highly sensitive (PII, PHI, cardholder data)
Evidence Required:
- Data classification policy
- Data inventory with classifications
- Labeling/tagging examples
DP-004: Implement Data Retention and Disposal
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Partial |
| Industries |
All |
Description: Define retention periods for different data types and securely dispose of data when no longer needed.
Framework Mappings:
- SOC 2: CC6.5
- ISO 27001: A.5.33
- HIPAA: 164.530(j)
- PCI-DSS: 3.1
- GDPR: Art.5(1)(e), Art.17
Implementation Guidance:
- Document retention requirements by data type
- Implement automated deletion for expired data
- Use secure deletion methods (cryptographic erasure, physical destruction)
- Maintain disposal logs
Evidence Required:
- Data retention policy
- Retention schedule by data type
- Disposal certificates
Network & Infrastructure Security
NET-001: Implement Network Segmentation
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Partial |
| Industries |
All |
Description: Segment networks to limit blast radius of security incidents and enforce least privilege at the network level.
Framework Mappings:
- SOC 2: CC6.6
- ISO 27001: A.8.22
- PCI-DSS: 1.3
- NIST CSF: PR.AC-5
Implementation Guidance:
- Separate production, development, and corporate networks
- Isolate sensitive data zones (cardholder data, PII)
- Implement micro-segmentation where possible
- Control traffic between segments with firewalls
Evidence Required:
- Network diagram
- Firewall rules
- Segmentation testing results
NET-002: Deploy Web Application Firewall (WAF)
| Attribute |
Value |
| Importance |
PREFERRED |
| Automation |
Full |
| Industries |
Technology, Finance, Retail |
Description: Protect web applications from common attacks (SQL injection, XSS, CSRF) with a WAF.
Framework Mappings:
- SOC 2: CC6.6
- PCI-DSS: 6.4
- NIST CSF: PR.PT-4
Implementation Guidance:
- Deploy WAF in front of all public-facing applications
- Configure rules for OWASP Top 10
- Enable logging and alerting
- Regularly update rule sets
Evidence Required:
- WAF configuration
- Blocked attack logs
- Rule update schedule
NET-003: Implement DDoS Protection
| Attribute |
Value |
| Importance |
PREFERRED |
| Automation |
Full |
| Industries |
Technology, Finance, Retail |
Description: Protect against distributed denial-of-service attacks that could impact availability.
Framework Mappings:
- SOC 2: A1.2
- ISO 27001: A.8.22
- NIST CSF: PR.DS-4
Implementation Guidance:
- Use cloud-based DDoS protection (Cloudflare, AWS Shield, Akamai)
- Configure rate limiting at the application level
- Implement geographic restrictions if appropriate
- Establish incident response procedures for DDoS
Evidence Required:
- DDoS protection configuration
- Rate limiting rules
- Incident response runbook
Application Security
APP-001: Implement Secure SDLC
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Partial |
| Industries |
All |
Description: Integrate security into every phase of the software development lifecycle.
Framework Mappings:
- SOC 2: CC8.1
- ISO 27001: A.8.25, A.8.26
- PCI-DSS: 6.3
- NIST CSF: PR.IP-2
Implementation Guidance:
- Threat modeling during design
- Secure coding standards and training
- Code review (manual and automated)
- Security testing (SAST, DAST, SCA)
- Penetration testing before release
Evidence Required:
- SDLC documentation
- Code review records
- Security testing results
APP-002: Run Static Application Security Testing (SAST)
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Full |
| Industries |
Technology |
Description: Analyze source code for security vulnerabilities before deployment.
Framework Mappings:
- SOC 2: CC8.1
- ISO 27001: A.8.28
- PCI-DSS: 6.3.2
- NIST CSF: DE.CM-4
Implementation Guidance:
- Integrate SAST into CI/CD pipeline
- Configure rules for relevant languages
- Establish remediation SLAs by severity
- Track trends over time
Evidence Required:
- SAST tool configuration
- Sample scan results
- Remediation tracking
APP-003: Run Dynamic Application Security Testing (DAST)
| Attribute |
Value |
| Importance |
PREFERRED |
| Automation |
Full |
| Industries |
Technology |
Description: Test running applications for vulnerabilities by simulating attacks.
Framework Mappings:
- SOC 2: CC8.1
- ISO 27001: A.8.28
- PCI-DSS: 6.3.2
Implementation Guidance:
- Run DAST scans in staging environment
- Schedule regular automated scans
- Test authentication, authorization, input validation
- Integrate with issue tracking
Evidence Required:
- DAST tool configuration
- Scan schedules
- Vulnerability trends
APP-004: Manage Open Source Dependencies
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Full |
| Industries |
Technology |
Description: Track and patch vulnerabilities in third-party libraries and dependencies.
Framework Mappings:
- SOC 2: CC8.1
- ISO 27001: A.8.28
- PCI-DSS: 6.3
- NIST CSF: ID.SC-2
Implementation Guidance:
- Use Software Composition Analysis (SCA) tools
- Maintain software bill of materials (SBOM)
- Monitor for new CVEs affecting dependencies
- Establish patching SLAs
Evidence Required:
- SCA tool configuration
- SBOM
- Patching records
Incident Response
IR-001: Establish Incident Response Plan
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Manual |
| Industries |
All |
Description: Document procedures for detecting, responding to, and recovering from security incidents.
Framework Mappings:
- SOC 2: CC7.3, CC7.4
- ISO 27001: A.5.24, A.5.25
- HIPAA: 164.308(a)(6)
- PCI-DSS: 12.10
- NIST CSF: RS.RP-1
- GDPR: Art.33
Implementation Guidance:
- Define incident severity levels
- Establish escalation procedures
- Document communication plans
- Include regulatory notification requirements
- Conduct regular drills
Evidence Required:
- Incident response plan
- Communication templates
- Drill records
IR-002: Conduct Tabletop Exercises
| Attribute |
Value |
| Importance |
PREFERRED |
| Automation |
Manual |
| Industries |
All |
Description: Practice incident response with simulated scenarios to identify gaps and improve readiness.
Framework Mappings:
- SOC 2: CC7.4
- ISO 27001: A.5.26
- NIST CSF: RS.IM-2
Implementation Guidance:
- Schedule quarterly tabletop exercises
- Use realistic scenarios (ransomware, data breach, DDoS)
- Include relevant stakeholders (IT, legal, PR)
- Document lessons learned
Evidence Required:
- Exercise schedule
- Scenario documentation
- After-action reports
Logging & Monitoring
LOG-001: Implement Centralized Logging
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Full |
| Industries |
All |
Description: Aggregate logs from all systems to a central location for analysis and retention.
Framework Mappings:
- SOC 2: CC7.1, CC7.2
- ISO 27001: A.8.15, A.8.16
- HIPAA: 164.312(b)
- PCI-DSS: 10.1
- NIST CSF: DE.AE-3
Implementation Guidance:
- Deploy SIEM or log management solution
- Configure all systems to forward logs
- Establish log retention (1 year minimum)
- Protect log integrity
Evidence Required:
- SIEM configuration
- Log source inventory
- Retention policy
LOG-002: Enable Security Alerting
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Full |
| Industries |
All |
Description: Configure alerts for security-relevant events to enable rapid response.
Framework Mappings:
- SOC 2: CC7.2
- ISO 27001: A.8.16
- PCI-DSS: 10.6
- NIST CSF: DE.CM-1
Implementation Guidance:
- Define alert rules for critical events
- Establish on-call rotation
- Configure escalation procedures
- Tune to reduce false positives
Alert Categories:
- Authentication failures
- Privilege escalation
- Configuration changes
- Malware detection
- Data exfiltration attempts
Evidence Required:
- Alert rules
- On-call schedule
- Alert response procedures
Compliance & Governance
GOV-001: Establish Security Policies
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Manual |
| Industries |
All |
Description: Document security policies that define expectations for the organization.
Framework Mappings:
- SOC 2: CC1.1
- ISO 27001: A.5.1
- HIPAA: 164.316
- PCI-DSS: 12.1
- NIST CSF: GV.PO-1
Required Policies:
- Information Security Policy
- Acceptable Use Policy
- Access Control Policy
- Data Classification Policy
- Incident Response Policy
- Business Continuity Policy
- Vendor Management Policy
Evidence Required:
- Policy documents
- Approval records
- Distribution/acknowledgment records
GOV-002: Conduct Risk Assessments
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Partial |
| Industries |
All |
Description: Regularly assess risks to identify, analyze, and prioritize security risks.
Framework Mappings:
- SOC 2: CC3.1, CC3.2
- ISO 27001: A.5.7, A.5.8
- HIPAA: 164.308(a)(1)
- PCI-DSS: 12.2
- NIST CSF: ID.RA-1
Implementation Guidance:
- Define risk assessment methodology
- Identify assets and threats
- Assess likelihood and impact
- Document risk treatment decisions
- Review annually or after significant changes
Evidence Required:
- Risk assessment methodology
- Risk register
- Treatment plans
Vendor & Third-Party Management
VEN-001: Assess Vendor Security
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Partial |
| Industries |
All |
Description: Evaluate security posture of vendors who access or process your data.
Framework Mappings:
- SOC 2: CC9.2
- ISO 27001: A.5.19, A.5.20
- HIPAA: 164.308(b)
- PCI-DSS: 12.8
- NIST CSF: ID.SC-1
Implementation Guidance:
- Categorize vendors by risk (data access, criticality)
- Request security certifications (SOC 2, ISO 27001)
- Conduct security questionnaires
- Review subprocessor lists
Evidence Required:
- Vendor inventory
- Security assessments
- BAA/DPA agreements
VEN-002: Include Security in Contracts
| Attribute |
Value |
| Importance |
MANDATORY |
| Automation |
Manual |
| Industries |
All |
Description: Include security requirements in vendor contracts.
Framework Mappings:
- SOC 2: CC9.2
- ISO 27001: A.5.20
- HIPAA: 164.308(b)(1)
- GDPR: Art.28
Required Clauses:
- Data protection requirements
- Incident notification obligations
- Right to audit
- Subprocessor restrictions
- Data return/deletion upon termination
Evidence Required:
- Contract templates
- Signed agreements
AI & Emerging Technology
AI-001: Establish AI Governance
| Attribute |
Value |
| Importance |
PREFERRED |
| Automation |
Manual |
| Industries |
Technology, Finance, Healthcare |
Description: Govern the development and use of AI systems within the organization.
Framework Mappings:
- NIST AI RMF: GV.1, GV.2
- EU AI Act: Art.9
- ISO 42001: 4.1, 5.1
Implementation Guidance:
- Define AI use policy
- Establish AI ethics committee
- Inventory AI systems by risk level
- Conduct AI impact assessments
Evidence Required:
- AI governance policy
- AI system inventory
- Impact assessments
AI-002: Ensure AI Transparency
| Attribute |
Value |
| Importance |
PREFERRED |
| Automation |
Partial |
| Industries |
Technology, Finance, Healthcare |
Description: Maintain transparency about AI system capabilities, limitations, and decisions.
Framework Mappings:
- NIST AI RMF: MAP.2
- EU AI Act: Art.13
- ISO 42001: 6.1
Implementation Guidance:
- Document AI model capabilities and limitations
- Provide explanations for AI decisions when required
- Disclose AI use to affected parties
- Maintain documentation of training data and methods
Evidence Required:
- Model documentation
- Explainability reports
- Disclosure notices
Using the Mitigations Library
In OMNI-GRC
- Navigate to Compliance → Industry Coverage
- Select an industry to see applicable mitigations
- View mitigation details and framework mappings
- Track implementation status
API Access
GET /api/data-library?type=mitigations
GET /api/data-library?type=mitigations&industry=healthcare
Resources
Last Updated: January 2026
Applies to: OMNI-GRC v0.1.0+