Question 1

What GRC frameworks does CATAAM support?

Accepted Answer

CATAAM supports SOC 2 (all five Trust Services Criteria), ISO 27001 (Annex A controls and Clause 4–10), HIPAA Security and Breach Notification Rules, PCI-DSS, NIST CSF, COBIT 5, and ITIL. Cross-framework control mapping means a single control implementation can simultaneously satisfy requirements across multiple frameworks — eliminating duplicated evidence collection.

Question 2

How does automated evidence harvesting work?

Accepted Answer

CATAAM connects to your existing tools — AWS, GitHub, and Jira — via native integrations. You define harvest rules once (e.g., "pull all IAM policy changes from AWS CloudTrail weekly") and the platform continuously collects evidence on schedule. Every piece of evidence is automatically linked to the relevant controls and compliance requirements, so auditors see a complete, timestamped trail with no manual uploads.

Question 3

What is Attack Surface Management (ASM) and what does CATAAM monitor?

Accepted Answer

Attack Surface Management (ASM) is the continuous discovery, inventory, and security assessment of all externally and internally reachable assets. CATAAM's External ASM monitors subdomains via certificate transparency logs (crt.sh), checks DNS health (SPF, DMARC, DNSSEC), detects open ports and exposed services, and maps every finding to MITRE ATT&CK techniques. Internal ASM (iASM) connects to AWS, Azure, and GCP to auto-discover cloud assets, visualize attack paths as a force-directed graph, and run automated security audits.

Question 4

What does Breach and Attack Simulation (BAS) test, and how does it differ from a penetration test?

Accepted Answer

Breach and Attack Simulation (BAS) continuously and safely executes real-world attack scenarios against your environment — unlike a penetration test, which is a one-time manual engagement. CATAAM's BAS tests AWS IAM privilege escalation, S3 ACL bypass, CloudTrail evasion, EC2 metadata exposure, SSH brute-force resistance, cipher weaknesses, and lateral movement paths. Every finding maps to specific CVEs and MITRE ATT&CK techniques, giving your team prioritized, actionable remediation steps rather than a static PDF report.

Question 5

How does CATAAM map findings to MITRE ATT&CK?

Accepted Answer

Every ASM and BAS finding in CATAAM is automatically tagged with the relevant MITRE ATT&CK technique IDs (e.g., T1078 Valid Accounts, T1530 Data from Cloud Storage). The platform displays the tactic category (Initial Access, Privilege Escalation, Exfiltration, etc.), technique name, and a remediation recommendation. This lets security teams prioritize fixes by attacker impact rather than CVSS score alone, and provides auditors with evidence that controls address specific threat vectors.

Question 6

What cloud platforms does CATAAM integrate with?

Accepted Answer

CATAAM integrates natively with AWS (EC2, RDS, S3, Lambda, IAM, CloudTrail, VPC), GitHub (repository access controls, code scanning alerts), and Jira (ticket-based evidence and remediation tracking). Azure and GCP asset discovery is supported for iASM. Additional integrations are added on a regular release cycle.

Question 7

How does cross-framework control mapping work?

Accepted Answer

Cross-framework control mapping identifies overlapping requirements across compliance standards. For example, the access control requirement in SOC 2 CC6.1, ISO 27001 A.9, and PCI-DSS Requirement 7 all address the same underlying security objective. When you implement the control once and attach evidence, CATAAM automatically satisfies the requirement across every mapped framework simultaneously — reducing compliance work by up to 60% for organizations pursuing multiple certifications.

Question 8

Can CPA firms and CISO resellers manage multiple client organizations?

Accepted Answer

Yes. The CATAAM Partner Program gives CPA audit firms and CISO-as-a-Service resellers a dedicated partner dashboard to onboard and manage unlimited client organizations. Each client gets their own isolated compliance environment. Partners switch between client contexts instantly, track per-client framework progress, and are billed post-paid at $99/framework/client/month with no upfront commitment. Partners receive 100 free iASM credits on activation.

Everything You Need for Compliance Automation & Security

Multi-Framework Compliance

Evidence Harvesting & Management

Partner & Multi-Org Management

Executive Reporting & Risk Score

External Attack Surface Monitoring

Internal Attack Surface Management (iASM)

Breach & Attack Simulation (BAS)

Marketplace & Vendor Risk

See Internal Attack Surface & Breach Simulation in Action

Free to Explore

50% Below Market Rate

CISO & CPA Partners

How It Works

Connect & Enroll

Collect Evidence

Remediate & Report

Integrations & Compatibility

AWS

Azure

GCP

Splunk

CrowdStrike

Rapid7

Jira

GitHub

GitLab

VMware

Kubernetes

Terraform

The CATAAM platform in 90 seconds

Ready to run your first compliance framework?