Integration · Identity & access

Okta integration for continuous SOC 2, ISO 27001 & PCI DSS compliance

CATAAM connects to Okta with read-only access and runs 6 automated checks against your real configuration. The results map to 10 controls across 10 frameworks, including SOC 2, ISO 27001, PCI DSS, GDPR, NIST CSF, SOC 1.

automated checks: 6
controls mapped: 10
frameworks: 10

What happens when you connect Okta

Connect with read-only access
Add a read-only role, OAuth scope or API token for Okta. The credential is encrypted at rest.
Discover assets
CATAAM pulls the accounts, users, repositories or devices it finds into one asset inventory.
Run 6 automated checks
Every check runs against your real configuration, then keeps running on a schedule.
Map results to 10 controls
Each result lands on the controls it proves — and counts for every framework that shares them.
Store evidence and raise issues
Passing checks become audit evidence. Failures show up for the control owner and can open a Jira issue.

The 6 checks CATAAM runs on Okta

Each check runs against your real Okta configuration and keeps running on a schedule. Check names are shown as they appear in the CATAAM platform.

Okta API tokens reviewed and not stale
Okta MFA enforced via policy
Okta inactive users disabled or removed
Okta password policy meets minimum security requirements
Okta sign-on policies enforce MFA
Okta system log exported to a SIEM

Controls these checks support (10)

A passing check becomes evidence for each control below, and counts for every framework that shares the control.

Control	Requirement	Frameworks
CRY-1	Unique production database authentication enforced	SOC 2, ISO 27001
IAC-1	Production application access restricted	SOC 2, ISO 27001, SOC 1
IAC-8	Access revoked upon termination	SOC 2, ISO 27001, SOC 1
IAC-11	Password policy enforced	SOC 2, PCI DSS, SOC 1
IAC-12	Remote access MFA enforced	SOC 2, ISO 27001, PCI DSS, NIST CSF, SOC 1 +1
MON-2	Log management utilized	SOC 2, PCI DSS, NIST CSF, COBIT 5, ITIL
CFG-19	Password policy enforced	GDPR
IAC-85	Remote access MFA enforced	GDPR, DPDP Act
TECH-02	Privileged Access Rights	ISO 27001, Essential Eight
TECH-11	Logging	ISO 27001

Okta integration: frequently asked questions

What does CATAAM check in Okta?

CATAAM runs 6 automated checks on Okta, for example: Okta API tokens reviewed and not stale; Okta MFA enforced via policy; Okta inactive users disabled or removed; Okta password policy meets minimum security requirements. The full list is on this page.

Which compliance frameworks does the Okta integration support?

The Okta checks map to 10 controls and count toward SOC 2, ISO 27001, PCI DSS, GDPR, NIST CSF, SOC 1.

Does CATAAM need write access to Okta?

No. Connectors use read-only roles, scopes or API tokens, and credentials are encrypted at rest. The only optional write anywhere in CATAAM is opening Jira issues for failed checks.

How do I connect Okta to CATAAM?

Add a read-only role, OAuth scope or API token for Okta in CATAAM. CATAAM then discovers your assets, runs the checks and keeps running them on a schedule, storing each result as audit evidence.