Integration · Code & DevOps

GitHub integration for continuous SOC 2, ISO 27001 & PCI DSS compliance

CATAAM connects to GitHub with read-only access and runs 12 automated checks against your real configuration. The results map to 7 controls across 10 frameworks, including SOC 2, ISO 27001, PCI DSS, GDPR, NIST CSF, SOC 1.

automated checks: 12
controls mapped: 7
frameworks: 10

What happens when you connect GitHub

Connect with read-only access
Add a read-only role, OAuth scope or API token for GitHub. The credential is encrypted at rest.
Discover assets
CATAAM pulls the accounts, users, repositories or devices it finds into one asset inventory.
Run 12 automated checks
Every check runs against your real configuration, then keeps running on a schedule.
Map results to 7 controls
Each result lands on the controls it proves — and counts for every framework that shares them.
Store evidence and raise issues
Passing checks become audit evidence. Failures show up for the control owner and can open a Jira issue.

The 12 checks CATAAM runs on GitHub

Each check runs against your real GitHub configuration and keeps running on a schedule. Check names are shown as they appear in the CATAAM platform.

Application changes reviewed
Author is not the reviewer of pull requests
CI/CD system in use
Critical vulnerabilities identified in packages are addressed (GitHub Repo)
Ensure branch protection rules are enforced for administrators (GitHub)
GitHub accounts deprovisioned when personnel leave
GitHub repository visibility has been set to private
High vulnerabilities identified in packages are addressed (GitHub Repo)
Low vulnerabilities identified in packages are addressed (GitHub Repo)
Medium vulnerabilities identified in packages are addressed (GitHub Repo)
No unreviewed direct pushes to the default branch (GitHub)
Vulnerability scanning is enabled (GitHub)

Controls these checks support (7)

A passing check becomes evidence for each control below, and counts for every framework that shares the control.

Control	Requirement	Frameworks
CFG-1	Configuration management system established	SOC 2, ISO 27001, PCI DSS, NIST CSF, COBIT 5 +1
CHG-1	Change management procedures enforced	SOC 2, ISO 27001, PCI DSS, NIST CSF, SOC 1 +2
CHG-2	Production deployment access restricted	SOC 2, ISO 27001, SOC 1, ITIL
IAC-8	Access revoked upon termination	SOC 2, ISO 27001, SOC 1
VPM-1	Service infrastructure maintained	SOC 2, COBIT 5, ITIL
VPM-2	Vulnerabilities scanned and remediated	SOC 2, ISO 27001, PCI DSS, NIST CSF, Essential Eight +3
IAC-87	Production deployment access restricted	GDPR

GitHub integration: frequently asked questions

What does CATAAM check in GitHub?

CATAAM runs 12 automated checks on GitHub, for example: Application changes reviewed; Author is not the reviewer of pull requests; CI/CD system in use; Critical vulnerabilities identified in packages are addressed (GitHub Repo). The full list is on this page.

Which compliance frameworks does the GitHub integration support?

The GitHub checks map to 7 controls and count toward SOC 2, ISO 27001, PCI DSS, GDPR, NIST CSF, SOC 1.

Does CATAAM need write access to GitHub?

No. Connectors use read-only roles, scopes or API tokens, and credentials are encrypted at rest. The only optional write anywhere in CATAAM is opening Jira issues for failed checks.

How do I connect GitHub to CATAAM?

Add a read-only role, OAuth scope or API token for GitHub in CATAAM. CATAAM then discovers your assets, runs the checks and keeps running them on a schedule, storing each result as audit evidence.