How to answer 'Are container images scanned for vulnerabilities before deployment?' on a SIG Lite
I. Reviewer Guidance & Pitfalls
Explain how container base images and application containers are scanned in the container registry (e.g., ECR/GCR/Trivy) and deployed as immutable images.
II. Example Answer Passing Enterprise Audit
Compliant Response
Sealed · TVM-09
Yes. All Docker container images are automatically scanned for OS and package vulnerabilities upon push to our container registry; images with unpatched critical CVEs cannot be deployed (SOC 2, CC7.1).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire drafts answers with citations pulled directly from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
No spam · No credit card · Confidential by default