CNCF Security Technical Advisory Group (TAG): every control, and what you already have

24 controls 4 frameworks share controls with it International (CNCF/Linux Foundation) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1	24	measure it →
NIST SP 800-53 Rev 5	18	measure it →
ISO 27002:2022	1	measure it →
NIST Cybersecurity Framework 2.0	1	measure it →

Every control

Code	Control	Also in
`CNCF-4C-CLOUD`	Cloud Layer Security	2
`CNCF-4C-CLUSTER`	Cluster Layer Security	2
`CNCF-4C-CODE`	Code Layer Security	2
`CNCF-4C-CONTAINER`	Container Layer Security	2
`CNCF-COMP-AUDITS`	Regulatory Audits	1
`CNCF-COMP-INDUSTRY`	Industry-Specific Compliance	1
`CNCF-DEP-ARTIFACTS`	Artifact and Image Verification	2
`CNCF-DEP-INCIDENT`	Incident Response and Mitigation	2
`CNCF-DEP-OBSERVABILITY`	Observability and Metrics	2
`CNCF-DEP-PREFLIGHT`	Pre-Flight Deployment Checks	1
`CNCF-DEV-CHECKS`	Security Checks in Development	2
`CNCF-DEV-TESTING`	Security Testing	3
`CNCF-DIST-IMGHARDEN`	Image Hardening	2
`CNCF-DIST-IMGSCAN`	Image Scanning	2
`CNCF-DIST-MANIFESTHARDEN`	Container Application Manifest Hardening	2
`CNCF-DIST-MANIFESTSCAN`	Container Application Manifest Scanning	2
`CNCF-DIST-PIPELINE`	Build Pipeline Security	1
`CNCF-RT-ACCESS`	Runtime Access (Identity, Authentication, Authorization)	3
`CNCF-RT-AVAILABILITY`	Runtime Availability	2
`CNCF-RT-COMPUTE`	Runtime Compute Security (Orchestration, Hosts, Containers)	2
`CNCF-RT-STORAGE`	Runtime Storage Security	2
`CNCF-SA-PRINCIPLES`	Security Principles	1
`CNCF-SA-STACK`	Security Stack and Tooling	1
`CNCF-SA-THREATMODEL`	Threat Modeling	2

Tell me when CNCF Security Technical Advisory Group (TAG) files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Threat models
Threat models for cloud-native systems covering trust boundaries
Threat-driven control selection

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

No threat modeling named by 3 frameworks

What this page is

A control-level reference for CNCF Security Technical Advisory Group (TAG), drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition