Where possible, examples of audit artifacts are included as evidence in the

VMware Cloud Foundation Audit Guide Appendix

, focused on compliance and producing evidence to meet controls. To map configurations across regulatory standards, we use a third-party tool produced by the Unified Compliance Framework (UCF). This removes a subjective, manual control cross-walk approach and replaces it with a repeatable and data driven methodology. The crosswalk or reference across regulatory standards is not a mapping matrix, but instead utilizes the UCF as a shared library of controls tied to the underlying citation text within each standard. This removes the subjective mapping and replaces it with a programmatic, software-driven mapping engine.

In some cases, the regulation may be too generic or too vague, which can reduce the mapping efficacy. In these cases, an additional review is performed to isolate new citation text and then included in the engine through the corresponding and newly identified UCF control. No mapping is provided with an accompany UCF control and accompanying citation text for each regulation. If no mapping is identified, the mapping uses

VMware Best Practice

text to clarify that mapping was not found but to keep up with the security principles, the configuration is recommended.

The compliance mapping is a subject of expansion, as more security controls are evaluated, including additional compliance domains and regulations.