# CATAAM — full index CATAAM is a compliance automation and security testing platform from TheMarkups Canada Inc. It automates evidence collection and continuous control monitoring for 14 frameworks — SOC 2, SOC 1, ISO 27001, ISO 42001, HIPAA, PCI DSS, GDPR, NIST CSF, COBIT 5, ITIL, India's DPDP Act, the ACSC Essential Eight, the Australian Privacy Principles and APRA CPS 234 — from one shared control set, connects to 429+ integrations, and bundles internal and external attack surface management (iASM/EASM) and breach & attack simulation (BAS) so controls are proven to work, not just documented. Plans are priced in USD from $149 per month with a 14-day free trial. Last updated: 2026-09-25. Short index: https://cataam.com/llms.txt ## Pages (title — description) - https://cataam.com/ — Compliance Automation for SOC 2, ISO 27001 & PCI-DSS — Automate SOC 2, ISO 27001, HIPAA & PCI-DSS evidence with built-in attack surface monitoring and breach simulation — about 50% below Qualys, Rapid7 & Tenable. - https://cataam.com/about/ — About — Learn about CATAAM and TheMarkups Canada Inc. — the team behind unified GRC, iASM, and BAS for CISOs, CPA firms, and enterprise security teams. - https://cataam.com/asm/ — Attack Surface Management (ASM & iASM) — Discover your full attack surface with CATAAM — external ASM, internal iASM, MITRE ATT&CK mapping, and cloud asset discovery for AWS, Azure, and GCP. - https://cataam.com/bas/ — Breach & Attack Simulation (BAS) — Continuously simulate real-world attacks on your cloud with CATAAM BAS — 200+ MITRE ATT&CK techniques that prove your SOC 2 and PCI-DSS controls actually work. - https://cataam.com/blog/ — Blog — Compliance & Security Guides — Practical guides on ISO 27001, SOC 2, and security compliance — checklists, cost breakdowns, and how to automate certification with CATAAM. - https://cataam.com/blog/agentic-ai-api-key-leak-cve-2026-67425/ — No, an AI Didn’t “Escape the Lab” This Week — It Leaked Your API Keys — CVE-2026-67425 (CVSS 8.6): an LLM library leaking API keys via SSRF — the real agentic-AI breach, not a rogue-AI story. Includes a 15-minute fix. - https://cataam.com/blog/ai-attack-surface-vulnerability-report-2026/ — We Analyzed 1,307 Vulnerabilities in 60 Days: Two-Thirds Were RCE, and AI Tools Are the New Attack Surface — CATAAM analyzed 1,307 vulnerabilities in 60 days: 67% were RCE, 72 in AI infrastructure (MCP, Langflow, Open WebUI) — mapped to SOC 2. - https://cataam.com/blog/apra-cps-234-explained/ — APRA CPS 234, Explained: Information Security for Banks, Insurers & Super Funds — A plain-English guide to APRA CPS 234: Board accountability, controls, testing, incident management, the 72-hour notification rule, and who must comply. - https://cataam.com/blog/australian-privacy-principles-explained/ — The Australian Privacy Principles (APPs), Explained: All 13 Principles, the NDB Scheme, and How to Comply — A plain-English guide to the 13 Australian Privacy Principles: what they require, the NDB scheme, who must comply, and reusing GDPR controls to get APP-ready. - https://cataam.com/blog/check-point-f5-arista-zero-days-september-2026/ — Four Exploited Zero-Days in One Week: Check Point, F5 BIG-IP APM and Arista VeloCloud Explained — CVE-2026-93616, CVE-2026-85102, CVE-2026-94127 and CVE-2026-93952: four exploited zero-days in the security control plane. Fixed builds and hunts inside. - https://cataam.com/blog/cisco-ise-email-gateway-zero-days-cve-2026-76460-76461/ — Two Cisco Zero-Days in 48 Hours: CVE-2026-76460 (ISE Auth Bypass) and CVE-2026-76461 (Secure Email Gateway Root RCE) Explained — CVE-2026-76460 (Cisco ISE auth bypass, CVSS 10) and CVE-2026-76461 (Email Gateway root RCE via one email): both exploited, no workaround. Fixed builds inside. - https://cataam.com/blog/cisco-secure-firewall-cve-2026-20349/ — Cisco Secure Firewall CVE-2026-20349: What It Is, Who’s Exposed, and How to Patch (with Commands) — CVE-2026-20349: an unauthenticated DoS flaw (CVSS 8.6) in Cisco Secure Firewall’s SSL VPN — actively exploited, no workaround. ASA/FTD patch commands inside. - https://cataam.com/blog/essential-eight-explained/ — The ACSC Essential Eight, Explained: The 8 Strategies, Maturity Levels 0–3, and How to Prove Them — A plain-English guide to the Essential Eight: all 8 strategies, the Maturity Model 0-3, who must comply, and proving it with evidence, not screenshots. - https://cataam.com/blog/eu-ai-act-article-12-logging/ — EU AI Act Article 12: Logging & Record-Keeping Requirements, Explained (2026) — A plain-English guide to EU AI Act Article 12 — the record-keeping and logging obligations for AI systems — and a practical way to generate the logs auditors expect. - https://cataam.com/blog/exposed-mcp-servers-attack-surface/ — Exposed MCP Servers Are the New Unguarded Door: The July 2026 CVE Wave and How to Find Yours — More than a dozen MCP server CVEs hit in July 2026 — built for localhost, shipped to the internet with no auth. Here is the wave, and how to find yours. - https://cataam.com/blog/grc-platform-vs-auditor/ — The Real Cost of SOC 2: Platform vs Auditor — You’ll hire a CPA either way — only they can sign a SOC 2 report. The real question is who collects six months of evidence: your engineers, or software? - https://cataam.com/blog/iso-27001-certification-checklist/ — ISO 27001 Certification Checklist (2026): 12 Steps to Certified — A practical, 12-step ISO 27001 certification checklist for 2026 — from defining ISMS scope and risk assessment to the Statement of Applicability and Stage 1 & 2 audits. - https://cataam.com/blog/iso-27001-cost-smb/ — The ISO 27001 Tax: Why It Costs SMBs a Fortune — A Founder’s Story — Why ISO 27001 costs so much for SMBs in 2026, how it compares to SOC 2, and CATAAM’s answer: transparent pricing from $149/mo per framework. - https://cataam.com/blog/iso-27001-cost/ — How Much Does ISO 27001 Certification Cost in 2026? — A clear 2026 breakdown of ISO 27001 certification cost — certification body audit fees, tooling, internal time, and how automation lowers the total cost of getting certified. - https://cataam.com/blog/iso-27001-vs-soc-2/ — ISO 27001 vs SOC 2: Which Should You Get First? (2026) — ISO 27001 vs SOC 2 compared for 2026 — what each is, who asks for them, how they overlap, and how to pursue both at once with cross-mapped evidence. - https://cataam.com/blog/iso-42001-annex-a-controls/ — ISO 42001 Annex A Controls Explained: All 9 Objectives — ISO/IEC 42001 Annex A: all 38 controls across nine objectives (A.2–A.10) — what each covers and how they map to your Statement of Applicability. - https://cataam.com/blog/iso-42001-cost/ — How Much Does ISO 42001 Certification Cost in 2026? — ISO 42001 certification cost breakdown for 2026: audit fees, tooling, and internal time — plus how automation cuts your total AIMS cost. - https://cataam.com/blog/iso-42001-readiness/ — Get Your Organization ISO 42001-Ready: A 2026 Readiness Guide — A practical guide to getting ISO/IEC 42001-ready — stand up an AI Management System (AIMS), inventory your AI estate, run AI risk and impact assessments, apply Annex A controls, and reach audit-ready faster. - https://cataam.com/blog/iso-42001-vs-iso-27001/ — ISO 42001 vs ISO 27001: AI Governance and Information Security, Compared — ISO 42001 vs ISO 27001 for 2026 — what each standard governs, how their management-system structure overlaps, where they differ, and how to run both together with cross-mapped evidence. - https://cataam.com/blog/koorier-soc2-okf-case-study/ — How a Logistics Company Passed SOC 2 with OKF and Claude — The Koorier Case Study — Koorier, a last-mile logistics company, had its SOC 2 evidence scattered across a dozen vendors. Here’s how it closed the gaps by turning its whole compliance program into an OKF knowledge graph the team queries through Claude over MCP — while CATAAM ASM, iASM, and red-team exercises found the real exposure. - https://cataam.com/blog/langflow-rce-cve-2026-9198/ — Langflow RCE (CVE-2026-9198): What Langflow Is, Who Got Hit, and How to Fix It — CVE-2026-9198: a critical unauthenticated RCE (CVSS 9.8) in IBM Langflow OSS 1.0.0-1.10.0, already used to plant cryptominers. How to check exposure and fix it. - https://cataam.com/blog/litellm-mcp-auth-bypass-cve-2026-59822/ — LiteLLM’s Fake-Token Flaw: A Breach Story — CVE-2026-59822 lets anyone hand LiteLLM a fake Bearer token and open an authenticated MCP session — reaching your AI tools and data. The story, and the fix. - https://cataam.com/blog/mcp-ai-tooling-cve-wave-widens/ — The MCP CVE Wave Didn’t Crest — It Broke Wider: A Second SDK, the Vendors’ Own Servers, and the First Exploited-in-the-Wild Bug — Six weeks after the July 2026 MCP vulnerability wave, it hasn’t slowed — it has widened. A second official SDK (Ruby) fell to the same DNS-rebinding and session bugs, GitHub’s, AWS’s and Apify’s own MCP servers shipped flaws, Langflow became the first MCP-ecosystem CVE exploited in the wild, and a new AI-native class — prompt-to-query injection — arrived. Here is the second wave and how to find your exposure. - https://cataam.com/blog/mcp-server-zero-day-soc2-iso-42001/ — The Tool Nobody Reviewed: An MCP Zero-Day Read Through SOC 2 and ISO 42001 — A missing path check in the mcp-atlassian MCP server let an AI agent exfiltrate production secrets via prompt injection — no credentials needed. Here is how it maps to SOC 2 and ISO 42001 controls. - https://cataam.com/blog/n-able-n-central-rce-cve-2026-86218/ — The Master Key: How CVE-2026-86218 Turns One MSP Server Into Thousands of Victims — CVE-2026-86218 is a CVSS 10.0 pre-auth RCE in N-able N-central, the software MSPs use to manage thousands of endpoints — and it is being exploited in the wild. - https://cataam.com/blog/netscaler-cve-2026-8452-explained/ — Citrix NetScaler CVE-2026-8452: How a "Denial-of-Service" Bug Became Unauthenticated Root — CVE-2026-8452: a NetScaler bug patched as denial-of-service turned out to give unauthenticated root. On CISA KEV — the fix and exposure check. - https://cataam.com/blog/npm-supply-chain-worm-shai-hulud-chaindrop/ — A Self-Propagating npm Worm Is Stealing Every Secret It Can Find: Shai-Hulud / ChainDrop, Explained — ChainDrop (Shai-Hulud: Here We Go Again) compromised 400+ npm packages, harvesting cloud keys, GitHub/SSH tokens and AI configs. How it works, what to rotate. - https://cataam.com/blog/okf-and-git/ — OKF + Git: Version-Controlled Knowledge Graphs as Markdown — Open Knowledge Format is plain Markdown, so it lives natively in Git — diffable, reviewable, version-controlled. That’s what makes an OKF graph powerful. - https://cataam.com/blog/okf-claude/ — OKF for Claude: Give Claude Your Real, Current Knowledge Graph over MCP — OKF (Open Knowledge Format) hands Claude a live, linked, verifiable knowledge graph over MCP instead of stale pasted docs. How OKF and Claude work together. - https://cataam.com/blog/okf-for-ai-agents/ — OKF in AI: Giving Agents Real, Current, Verifiable Context — OKF (Open Knowledge Format) hands AI agents a verifiable, graph-linked knowledge base instead of RAG chunks — grounded context, read natively over MCP. - https://cataam.com/blog/okf-vs-mcp/ — OKF vs MCP: How Open Knowledge Format and the Model Context Protocol Work Together — OKF and MCP are often mentioned together — and confused. They are complementary: OKF is the format your knowledge lives in, MCP is how an agent fetches it. Here’s how they fit. - https://cataam.com/blog/oracle-ebs-cve-2026-46817/ — Oracle E-Business Suite Under Attack (CVE-2026-46817): A CVSS 9.8 Payments Takeover, Read Through SOC 2 and ISO 27001 — A no-login flaw in Oracle Payments — CVE-2026-46817, CVSS 9.8 — is being exploited in the wild, and CISA has ordered emergency patching. Here is what the Oracle E-Business Suite zero-day means for your attack surface, and for the SOC 2, ISO 27001, and PCI DSS controls you were certified against. - https://cataam.com/blog/prompt-guard-stop-secrets-leaking-to-llms/ — Prompt Guard: Stop Secrets Leaking into ChatGPT & Claude — and Prove It for ISO 42001 — Meet Prompt Guard, CATAAM’s new open-source tool that redacts secrets and PII before they reach public LLMs — reversibly — and turns every prevented leak into ISO 42001 / EU AI Act evidence. - https://cataam.com/blog/securing-cisco-secure-firewall-guide/ — Securing Cisco Secure Firewall (ASA & FTD): A Vulnerability-Management & Hardening Guide — A practical, evergreen guide to securing Cisco Secure Firewall (ASA and FTD): why the network edge is the most-attacked surface, a repeatable vulnerability-management lifecycle for firewall appliances, a remote-access SSL VPN hardening checklist, how to know what you expose, and how to map it all to SOC 2 and ISO 27001 evidence. - https://cataam.com/blog/shadow-ai-secrets-in-chatgpt/ — Shadow AI: Your Employees Are Pasting Secrets into ChatGPT (How to Stop It in 2026) — Shadow AI — staff using public LLMs like ChatGPT and Claude without oversight — is the fastest-growing data-loss channel. Here’s the risk, why network DLP misses it, and a local-first fix. - https://cataam.com/blog/soc-2-cost/ — SOC 2 Cost in 2026: Software Pricing Compared — What SOC 2 costs in 2026 — audit fees, software pricing by platform (Vanta, Drata, Secureframe & more), and pen testing. CATAAM is transparent from $149/mo. - https://cataam.com/blog/soc2-journey-explained/ — The SOC 2 Journey, Explained: From Zero to Audit-Ready in 9 Steps — The complete SOC 2 roadmap for B2B SaaS: SOC 2 vs ISO 27001, Trust Services Criteria, controls, evidence, vendor risk, and the trust center for questionnaires. - https://cataam.com/blog/vendor-integrations-continuous-compliance/ — One Connector, One Compliance Test: How We Built 428 Integrations — Last week CATAAM shipped 428 connectable vendor integrations — and each one automatically runs a real compliance test. The engineering behind continuous compliance automation. - https://cataam.com/blog/what-is-an-aims-iso-42001/ — What Is an AIMS? The ISO 42001 AI Management System, Explained — A plain-English guide to the AI Management System (AIMS) defined by ISO/IEC 42001 — what it is, what’s inside it, how it differs from an ISMS, and how to stand one up. - https://cataam.com/blog/what-is-open-knowledge-format/ — What Is OKF (Open Knowledge Format)? Google’s Open Standard, Explained — OKF (Open Knowledge Format) is Google’s open standard for packaging data as graph-linked Markdown that AI agents read natively — no RAG chunking required. - https://cataam.com/blog/what-is-red-teaming/ — What Is Red Teaming? How Attackers Really Break In — and How CATAAM Tests It — Red teaming is goal-based adversary emulation: a controlled attack that proves whether your defenses actually hold — not a checklist. Here’s how a real engagement works (recon → foothold → lateral movement → objective → report), what it finds that scanners miss, how it maps to SOC 2 and ISO 27001, and how CATAAM delivers it. - https://cataam.com/blog/zero-trust-for-ai-agents/ — Zero Trust for Autonomous AI Agents: Identity, Network & Telemetry — AI agents running on broad API keys and standing access are a Zero Trust gap. The 3-layer fix — identities, network, telemetry — mapped to SOC 2 & ISO 42001. - https://cataam.com/business-contact/ — Business Inquiries — Enterprise and partnership inquiries for CATAAM — CISO reseller programs, CPA firm partnerships, and volume licensing. - https://cataam.com/careers/ — Careers at CATAAM — Remote Compliance & Security Jobs — Join CATAAM to build compliance automation pairing SOC 2, ISO 27001 & PCI-DSS with breach simulation and attack-surface management. Remote roles, US & Canada. - https://cataam.com/careers/developer-advocate/ — Developer Advocate (DevRel) | Careers at CATAAM — Grow the developer ecosystem around CATAAM — including our Claude MCP plugin — through docs, demos, sample code and technical content that brings security-mi… - https://cataam.com/careers/founding-account-executive/ — Founding Account Executive | Careers at CATAAM — Own the full sales cycle for a compliance automation platform that pairs SOC 2, ISO 27001 and PCI-DSS automation with breach-and-attack simulation and attack… - https://cataam.com/careers/growth-demand-generation-marketer/ — Growth / Demand-Generation Marketer | Careers at CATAAM — Own demand generation end to end — SEO, content, paid and lifecycle — and turn our growing organic footprint into a predictable pipeline of demos. - https://cataam.com/careers/growth-marketing-intern/ — Growth Marketing Intern | Careers at CATAAM — Hands-on internship supporting our content and SEO engine — research, draft and publish pages, and help run growth experiments that drive demos. - https://cataam.com/careers/sales-development-representative/ — Sales Development Representative (SDR) | Careers at CATAAM — Build the top of the funnel: research accounts, run outbound, and book qualified demos with security and compliance buyers across the US and Canada. - https://cataam.com/careers/security-research-intern/ — Security Research Intern | Careers at CATAAM — Work alongside our security team on attack-surface and breach-simulation research, tooling and content — a technical internship with real, shipped output. - https://cataam.com/careers/solutions-engineer/ — Solutions Engineer | Careers at CATAAM — Be the technical partner in every deal: run demos and POCs, handle security questionnaires, and integrate CATAAM into prospects’ cloud and compliance stacks. - https://cataam.com/claude-plugin/ — CATAAM for Claude — MCP Server & Plugin — Connect Claude to CATAAM’s MCP server and plugin. Review SOC 2, GDPR & ISO 27001 audit readiness, triage failing controls, and remediate from Claude Code. - https://cataam.com/compare/ — Compliance Software Comparisons & Alternatives (2026) — Compare compliance automation platforms, see the best software by framework, weigh CATAAM against Vanta, Drata, Secureframe & more, and understand framework differences like SOC 2 vs ISO 27001 — all in one hub. - https://cataam.com/compare/australian-privacy-principles-vs-gdpr/ — Australian Privacy Principles vs GDPR: Key Differences (2026) — Australian Privacy Principles (APPs) vs GDPR compared — the differences, NDB vs GDPR breach rules, and how CATAAM automates both from one control set. - https://cataam.com/compare/best-compliance-automation-software/ — Best Compliance Automation Software & Platforms (2026) Compared — Compare the best compliance automation software 2026 — CATAAM vs Vanta, Drata, Secureframe & Sprinto on frameworks, security testing & price, from $149/mo. - https://cataam.com/compare/best-continuous-compliance-monitoring/ — Best Continuous Compliance Monitoring Software (2026) — Compare the best continuous compliance monitoring tools in 2026 — CATAAM vs Vanta & Drata on real-time control checks, drift alerts and price, from $149/mo. - https://cataam.com/compare/best-dpdp-compliance-software/ — Best DPDP Act Compliance Software (2026) — India — Compare the best DPDP Act compliance software in 2026 for Indian data fiduciaries — CATAAM vs Vanta, Drata, Secureframe, Sprinto, Scytale & Scrut on reasonable security safeguards, breach reporting, security testing & price, from $149/mo. - https://cataam.com/compare/best-gdpr-compliance-software/ — Best GDPR Compliance Software (2026) Compared — Compare the best GDPR compliance software in 2026 — CATAAM vs Vanta, Drata, Secureframe, Sprinto, Scytale & Scrut on Article 32 security measures, records of processing, security testing & price, from $149/mo. - https://cataam.com/compare/best-hipaa-compliance-software/ — Best HIPAA Compliance Software (2026) Compared — Compare the best HIPAA compliance software in 2026 — CATAAM vs Vanta, Drata, Secureframe, Sprinto, Scytale & Scrut on the Security Rule, risk analysis, BAAs, security testing & price, from $149/mo. - https://cataam.com/compare/best-iso27001-software/ — Best ISO 27001 Compliance Software (2026) Compared — Compare the best ISO 27001 software in 2026 — CATAAM vs Vanta, Drata & Secureframe on ISMS, Statement of Applicability, Annex A evidence & price, from $149/mo. - https://cataam.com/compare/best-soc2-software/ — Best SOC 2 Compliance Software (2026) Compared — Compare the best SOC 2 software in 2026 — CATAAM vs Vanta, Drata, Secureframe, Sprinto & Scrut on Type I/II, evidence automation and price, from $149/mo. - https://cataam.com/compare/cataam-vs-drata/ — CATAAM vs Drata: Compliance + Built-In Security Testing — Drata vs CATAAM for SOC 2 & ISO 27001. CATAAM bundles attack surface management and breach simulation with evidence automation, about 50% below market. - https://cataam.com/compare/cataam-vs-qualys/ — CATAAM vs Qualys — GRC & Security Platform — CATAAM vs Qualys: compliance-first GRC with iASM and BAS versus a legacy vulnerability scanner. See which platform covers SOC 2, ISO 27001, and cloud security. - https://cataam.com/compare/cataam-vs-scrut/ — CATAAM vs Scrut: A Compliance Automation Alternative — Scrut alternative? CATAAM automates SOC 2 & ISO 27001 evidence and adds breach simulation plus attack surface monitoring that Scrut lacks. Compare features. - https://cataam.com/compare/cataam-vs-scytale/ — CATAAM vs Scytale: A Compliance Automation Alternative — Scytale alternative? CATAAM automates SOC 2 & ISO 27001 evidence and adds breach simulation plus attack surface monitoring at half the price. Compare features. - https://cataam.com/compare/cataam-vs-secureframe/ — CATAAM vs Secureframe: A Compliance Automation Alternative — Secureframe alternative? CATAAM automates SOC 2 & ISO 27001 evidence plus breach simulation and attack surface monitoring at half the price. Compare features. - https://cataam.com/compare/cataam-vs-sprinto/ — CATAAM vs Sprinto: A Compliance Automation Alternative — Sprinto alternative? CATAAM automates SOC 2 & ISO 27001 evidence and adds breach simulation plus attack surface monitoring at half the price. Compare features. - https://cataam.com/compare/cataam-vs-vanta/ — CATAAM vs Vanta: A 50%-Cheaper Compliance Alternative — Vanta vs CATAAM for SOC 2 & ISO 27001? CATAAM adds attack surface monitoring and breach simulation at half the price. See the full comparison. - https://cataam.com/compare/drata-alternatives/ — Best Drata Alternatives (2026): Top 6 Compared — Looking for a Drata alternative in 2026? The top 6 compared — CATAAM, Vanta, Secureframe, Sprinto & Scrut — on frameworks, security testing and price. - https://cataam.com/compare/essential-eight-vs-iso-27001/ — Essential Eight vs ISO 27001: Which Do You Need? (2026) — Essential Eight vs ISO 27001 compared: Australian technical baseline vs certifiable global ISMS — overlap, which you need, and how CATAAM automates both. - https://cataam.com/compare/gdpr-vs-dpdp/ — GDPR vs India’s DPDP Act: Key Differences for Compliance (2026) — GDPR vs DPDP Act compared in 2026 — the differences, where they overlap, which you need, and how CATAAM automates both from one control set. Answer-first, with FAQ. - https://cataam.com/compare/hipaa-vs-soc-2/ — HIPAA vs SOC 2: Differences, Overlap & Which You Need (2026) — HIPAA vs SOC 2 compared in 2026 — the differences, where they overlap, which you need, and how CATAAM automates both from one control set. Answer-first, with FAQ. - https://cataam.com/compare/hyperproof-alternatives/ — Best Hyperproof Alternatives (2026): Top 6 Compared — The best Hyperproof alternatives in 2026 compared — CATAAM vs Vanta, Drata, Secureframe, Sprinto & Scrut on frameworks, evidence automation, security testing and price, from $149/mo. - https://cataam.com/compare/scrut-alternatives/ — Best Scrut Alternatives (2026): Top 6 Compared — The best Scrut alternatives in 2026 compared — CATAAM vs Vanta, Drata, Secureframe, Sprinto & Scrut on frameworks, evidence automation, security testing and price, from $149/mo. - https://cataam.com/compare/secureframe-alternatives/ — Best Secureframe Alternatives (2026): Top 6 Compared — Top Secureframe alternatives for 2026, compared. CATAAM adds built-in security testing (BAS + pen-test) at ~half the price — from $149/mo, no annual contract. - https://cataam.com/compare/soc-1-vs-soc-2/ — SOC 1 vs SOC 2: What’s the Difference & Which Do You Need? (2026) — SOC 1 vs SOC 2 compared in 2026 — the differences, where they overlap, which you need, and how CATAAM automates both from one control set. Answer-first, with FAQ. - https://cataam.com/compare/soc-2-type-1-vs-type-2/ — SOC 2 Type 1 vs Type 2: Differences & Which to Get First (2026) — SOC 2 Type 1 vs SOC 2 Type 2 compared in 2026 — the differences, where they overlap, which you need, and how CATAAM automates both from one control set. Answer-first, with FAQ. - https://cataam.com/compare/soc-2-vs-iso-27001/ — SOC 2 vs ISO 27001: Differences, Overlap & Which You Need (2026) — SOC 2 vs ISO 27001 compared in 2026 — the differences, where they overlap, which you need, and how CATAAM automates both from one control set. Answer-first, with FAQ. - https://cataam.com/compare/sprinto-alternatives/ — Best Sprinto Alternatives (2026): Top 6 Compared — The best Sprinto alternatives in 2026 compared — CATAAM vs Vanta, Drata & Secureframe on frameworks, evidence automation and price, from $149/mo. - https://cataam.com/compare/thoropass-alternatives/ — Best Thoropass Alternatives (2026): Top 6 Compared — The best Thoropass alternatives in 2026 compared — CATAAM vs Vanta, Drata, Secureframe, Sprinto & Scrut on frameworks, evidence automation, security testing and price, from $149/mo. - https://cataam.com/compare/tugboat-alternatives/ — Best Tugboat Logic Alternatives (2026): Top 6 Compared — The best Tugboat Logic alternatives in 2026 compared — CATAAM vs Vanta, Drata, Secureframe, Sprinto & Scrut on frameworks, evidence automation, security testing and price, from $149/mo. - https://cataam.com/compare/vanta-alternatives/ — Best Vanta Alternatives (2026): Top 6 Compared — Top Vanta alternatives for 2026, compared. CATAAM adds built-in security testing (BAS + pen-test) at ~half Vanta's price — from $149/mo, no annual contract. - https://cataam.com/compliance/apra-cps-234/ — APRA CPS 234 Compliance Automation (Australia) — Automate APRA CPS 234 — Board accountability, control testing, incident management & 72-hour APRA notification. Reuse ISO 27001/SOC 2 controls. From $149/mo. - https://cataam.com/compliance/australian-privacy-principles/ — Australian Privacy Principles (APPs) Compliance Automation — Automate the Australian Privacy Principles (Privacy Act 1988) — all 13 APPs plus the NDB breach scheme, reusing your GDPR controls. From $149/mo. - https://cataam.com/compliance/dpdp/ — DPDP Act Compliance Automation (India) — Automate India’s DPDP Act 2023 + Rules 2025 in CATAAM — consent, Data Principal rights, Rule 6 safeguards & breach reporting. From $149/mo. - https://cataam.com/compliance/essential-eight/ — Essential Eight Compliance Automation (Australia) — Automate the ACSC Essential Eight — all 8 strategies validated with live evidence across Maturity Levels 1-3, cross-mapped to ISO 27001 & SOC 2. From $149/mo. - https://cataam.com/compliance/hipaa/ — HIPAA Compliance Automation — Automate HIPAA Security Rule compliance with continuous ePHI monitoring, audit log harvesting, security risk analysis, and breach notification documentation. - https://cataam.com/compliance/iso27001/ — ISO 27001 Compliance Automation (2026) — Automate ISO 27001 ISMS compliance — continuous evidence, risk assessments & Statement of Applicability, plus built-in security testing. From $149/mo. - https://cataam.com/compliance/iso42001/ — ISO 42001 AI Management System Automation — Automate ISO/IEC 42001 AI Management System compliance — govern your AI estate, validate every Annex A control, and generate the Statement of Applicability. - https://cataam.com/compliance/pci-dss/ — PCI-DSS Compliance Automation — Automate PCI-DSS v4.0 compliance with continuous penetration testing via BAS, network monitoring, and QSA-ready evidence packages for merchants & providers. - https://cataam.com/compliance/soc2/ — SOC 2 Compliance Automation Software (2026) — Automate SOC 2 Type II compliance — map all 64 Trust Services Criteria, harvest evidence from AWS, GitHub & Jira, and validate with built-in BAS. From $149/mo. - https://cataam.com/contact/ — Contact — Get in touch with CATAAM — reach us for product demos, partnership inquiries, or support. - https://cataam.com/demo/ — Book a CATAAM Demo — 5-Minute Walkthrough — See how CATAAM automates SOC 2, ISO 27001, HIPAA & PCI-DSS evidence and continuous control monitoring. Book a 5-minute walkthrough for security teams. - https://cataam.com/demos/ — Product Demos & Tutorials — Watch CATAAM in action — product demo, SOC 2 readiness, breach & attack simulation, plus how-to guides for Jira, the Claude MCP connector and integrations. - https://cataam.com/docs/jira/ — Jira Integration — Connect CATAAM to Jira — two-way sync between iASM findings, compliance test failures, and Jira issues. Built on Atlassian Forge and now live on the Atlassian Marketplace. - https://cataam.com/features/ — Features — Explore CATAAM's GRC, iASM, and BAS features — automated compliance, internal attack surface management, breach simulation, and cloud asset discovery. - https://cataam.com/get-started/ — Get Started — Free Trial — Start your 14-day free trial of CATAAM GRC, iASM, and BAS. No credit card required. Full access to SOC 2, ISO 27001, HIPAA, and PCI-DSS compliance automation. - https://cataam.com/glossary/ — Security & Compliance Glossary — Plain-English definitions of security and compliance terms — SOC 2, ISO 27001, ISO 42001, BAS, iASM, attack paths, and more. The CATAAM glossary. - https://cataam.com/glossary/access-review/ — What is Access Review? Definition, How It Works & FAQ — An access review is a periodic check that each user's permissions still match what their role actually requires. By confirming and revoking access on a rec… - https://cataam.com/glossary/ai-impact-assessment/ — What is AI Impact Assessment? Definition, How It Works & FAQ — An AI impact assessment is a structured evaluation of how an AI system affects individuals, groups, and society, including risks to rights, fairness, safet… - https://cataam.com/glossary/aims/ — What is AIMS? Definition, How It Works & FAQ — An AIMS (AI Management System) is the structured set of policies, processes, roles, and controls an organization uses to govern the responsible development… - https://cataam.com/glossary/annex-a-controls/ — What is Annex A Controls? Definition, How It Works & FAQ — Annex A controls are the catalog of security or AI controls listed in the annex of an ISO management-system standard. ISO 27001:2022 defines 93 controls ac… - https://cataam.com/glossary/attack-path/ — What is Attack Path? Definition, How It Works & FAQ — An attack path is the chain of steps an attacker takes, from an initial foothold through exploitation and pivoting, to reach a high-value target. It combin… - https://cataam.com/glossary/attack-surface-management/ — What is Attack Surface Management? Definition, How It Works & FAQ — Attack Surface Management (ASM) is the continuous discovery, inventory, and monitoring of an organization's internet-facing assets that an attacker could t… - https://cataam.com/glossary/attestation/ — What is Attestation? Definition, How It Works & FAQ — An attestation is a CPA firm's formal opinion on whether an organization's controls are designed and operating as described, most commonly delivered as a S… - https://cataam.com/glossary/breach-and-attack-simulation/ — What is Breach and Attack Simulation? Definition, How It Works & FAQ — Breach and Attack Simulation (BAS) is the practice of safely emulating real adversary techniques to validate whether security controls detect and stop them… - https://cataam.com/glossary/business-associate-agreement/ — What is Business Associate Agreement? Definition, How It Works & FAQ — A Business Associate Agreement (BAA) is a HIPAA-required contract between a covered entity (or a business associate) and a vendor that creates, receives, m… - https://cataam.com/glossary/cmmc/ — What is CMMC? Definition, How It Works & FAQ — CMMC (Cybersecurity Maturity Model Certification) is a US Department of Defense program that verifies defense contractors and subcontractors have adequate … - https://cataam.com/glossary/compensating-control/ — What is Compensating Control? Definition, How It Works & FAQ — A compensating control is an alternative safeguard used when an organization cannot implement a required control, but still needs to meet the intent of tha… - https://cataam.com/glossary/continuous-control-monitoring/ — What is Continuous Control Monitoring? Definition, How It Works & FAQ — Continuous control monitoring (CCM) is the practice of automatically and continuously testing whether controls operate correctly, then surfacing an alert a… - https://cataam.com/glossary/cve/ — What is CVE? Definition, How It Works & FAQ — CVE stands for Common Vulnerabilities and Exposures, a system that assigns a unique identifier to each publicly disclosed cybersecurity vulnerability. A CV… - https://cataam.com/glossary/cvss/ — What is CVSS? Definition, How It Works & FAQ — CVSS, the Common Vulnerability Scoring System, is an open framework for rating the severity of software vulnerabilities on a numerical scale from 0.0 to 10… - https://cataam.com/glossary/data-processing-agreement/ — What is Data Processing Agreement? Definition, How It Works & FAQ — A Data Processing Agreement (DPA) is a contract between a data controller and a data processor that governs how the processor may handle personal data on t… - https://cataam.com/glossary/data-subject-access-request/ — What is Data Subject Access Request? Definition, How It Works & FAQ — A Data Subject Access Request (DSAR) is a request by an individual to exercise their rights over their personal data - most commonly to access a copy of th… - https://cataam.com/glossary/dpdp-act/ — What is DPDP Act? Definition, How It Works & FAQ — The Digital Personal Data Protection (DPDP) Act, 2023 is India's national data-protection law. It governs the processing of digital personal data of indivi… - https://cataam.com/glossary/eu-ai-act/ — What is EU AI Act? Definition, How It Works & FAQ — The EU AI Act is the European Union's comprehensive, risk-based regulation governing artificial intelligence. It classifies AI systems by risk — unacceptab… - https://cataam.com/glossary/evidence-collection/ — What is Evidence Collection? Definition, How It Works & FAQ — Evidence collection is the process of gathering proof that security and compliance controls actually operate as intended. This proof includes system config… - https://cataam.com/glossary/fedramp/ — What is FedRAMP? Definition, How It Works & FAQ — FedRAMP (Federal Risk and Authorization Management Program) is a US government program that standardizes the security assessment, authorization, and contin… - https://cataam.com/glossary/gap-analysis/ — What is Gap Analysis? Definition, How It Works & FAQ — A gap analysis compares an organization's current controls against the requirements of a framework to identify what is missing before an audit. It produces… - https://cataam.com/glossary/gdpr/ — What is GDPR? Definition, How It Works & FAQ — GDPR is the European Union's General Data Protection Regulation, a comprehensive data-protection law governing how personal data of individuals in the EU a… - https://cataam.com/glossary/hipaa/ — What is HIPAA? Definition, How It Works & FAQ — HIPAA is the US federal law that sets national standards for protecting individuals' health information. Enforced by the HHS Office for Civil Rights, it go… - https://cataam.com/glossary/hitrust/ — What is HITRUST? Definition, How It Works & FAQ — HITRUST is a certifiable security and privacy framework, delivered through the HITRUST CSF, that harmonizes requirements from HIPAA, ISO 27001, NIST, PCI D… - https://cataam.com/glossary/internal-attack-surface-management/ — What is Internal Attack Surface Management? Definition, How It Works & FAQ — Internal Attack Surface Management (iASM) is the discovery and mapping of internal cloud and identity assets and the attack paths between them. It takes an… - https://cataam.com/glossary/internal-audit/ — What is Internal Audit? Definition, How It Works & FAQ — An internal audit is a self-assessment an organization performs on its own management system before an external certification or examination. Its purpose i… - https://cataam.com/glossary/isms/ — What is ISMS? Definition, How It Works & FAQ — An ISMS (Information Security Management System) is the structured set of policies, procedures, roles, and controls an organization uses to manage informat… - https://cataam.com/glossary/iso-27001/ — What is ISO 27001? Definition, How It Works & FAQ — ISO 27001 is the international standard for an information security management system (ISMS), published by ISO and IEC. It defines requirements for systema… - https://cataam.com/glossary/iso-27701/ — What is ISO 27701? Definition, How It Works & FAQ — ISO 27701 is an international standard that extends ISO 27001 and ISO 27002 with requirements for a Privacy Information Management System (PIMS). It adds p… - https://cataam.com/glossary/iso-42001/ — What is ISO 42001? Definition, How It Works & FAQ — ISO 42001 is the world's first international standard for an artificial intelligence management system (AIMS), published in 2023 by ISO and IEC. It defines… - https://cataam.com/glossary/lateral-movement/ — What is Lateral Movement? Definition, How It Works & FAQ — Lateral movement is the set of techniques an attacker uses to move from an initially compromised system to other systems inside a network, hunting for the … - https://cataam.com/glossary/least-privilege/ — What is Least Privilege? Definition, How It Works & FAQ — Least privilege is the security principle of granting every user, account, and process only the access it genuinely needs to perform its function, and no m… - https://cataam.com/glossary/mitre-attack/ — What is MITRE ATT&CK? Definition, How It Works & FAQ — MITRE ATT&CK is a free, globally used knowledge base of real-world adversary tactics and techniques observed in actual intrusions. It gives offense and def… - https://cataam.com/glossary/nist-ai-rmf/ — What is NIST AI RMF? Definition, How It Works & FAQ — NIST AI RMF (AI Risk Management Framework) is a voluntary US framework published by the National Institute of Standards and Technology to help organization… - https://cataam.com/glossary/nist-csf/ — What is NIST Cybersecurity Framework? Definition, How It Works & FAQ — The NIST Cybersecurity Framework (NIST CSF) is a voluntary framework from the US National Institute of Standards and Technology that helps organizations ma… - https://cataam.com/glossary/open-knowledge-format/ — What is Open Knowledge Format? Definition, How It Works & FAQ — Open Knowledge Format, or OKF, is an open, vendor-neutral standard for packaging information as graph-linked Markdown that AI agents can read natively. Rat… - https://cataam.com/glossary/pci-dss/ — What is PCI DSS? Definition, How It Works & FAQ — PCI DSS is the Payment Card Industry Data Security Standard, a set of security requirements that any organization storing, processing, or transmitting paym… - https://cataam.com/glossary/penetration-testing/ — What is Penetration Testing? Definition, How It Works & FAQ — Penetration testing is an authorized, simulated attack carried out by skilled humans to find and exploit vulnerabilities in a system. It is point-in-time a… - https://cataam.com/glossary/privilege-escalation/ — What is Privilege Escalation? Definition, How It Works & FAQ — Privilege escalation is the act of gaining higher access than you started with, such as moving from a standard user to an administrator. It is a key step i… - https://cataam.com/glossary/residual-risk/ — What is Residual Risk? Definition, How It Works & FAQ — Residual risk is the risk that remains after controls and other treatments have been applied. No safeguard eliminates risk entirely, so a measurable amount… - https://cataam.com/glossary/responsible-ai/ — What is Responsible AI? Definition, How It Works & FAQ — Responsible AI, also called trustworthy AI, is the practice of developing and using AI systems that are fair, transparent, accountable, safe, and respectfu… - https://cataam.com/glossary/risk-assessment/ — What is Risk Assessment? Definition, How It Works & FAQ — A risk assessment is the process of identifying assets, threats, and vulnerabilities, then scoring each risk by its likelihood and impact. It is the analyt… - https://cataam.com/glossary/risk-treatment/ — What is Risk Treatment? Definition, How It Works & FAQ — Risk treatment is the process of deciding how to handle each risk identified in a risk assessment, by mitigating, accepting, transferring, or avoiding it. … - https://cataam.com/glossary/security-posture/ — What is Security Posture? Definition, How It Works & FAQ — Security posture is the overall strength of an organization's cybersecurity at a given point in time, reflecting the state of its controls, its exposure to… - https://cataam.com/glossary/segregation-of-duties/ — What is Segregation of Duties? Definition, How It Works & FAQ — Segregation of duties (SoD) is the practice of splitting a critical task across multiple people so that no single individual can complete a sensitive actio… - https://cataam.com/glossary/soc-1/ — What is SOC 1? Definition, How It Works & FAQ — SOC 1 is an attestation report, defined by the AICPA under SSAE 18, that evaluates a service organization's controls relevant to its customers' internal co… - https://cataam.com/glossary/soc-2-type-1/ — What is SOC 2 Type I? Definition, How It Works & FAQ — SOC 2 Type I is a SOC 2 report that evaluates whether a service organization's controls are suitably designed to meet the relevant Trust Services Criteria … - https://cataam.com/glossary/soc-2-type-2/ — What is SOC 2 Type II? Definition, How It Works & FAQ — SOC 2 Type II is a SOC 2 report that evaluates whether a service organization's controls not only are designed appropriately but also operate effectively o… - https://cataam.com/glossary/soc-2/ — What is SOC 2? Definition, How It Works & FAQ — SOC 2 is an attestation report, defined by the AICPA, that evaluates how a service organization protects customer data against five Trust Services Criteria… - https://cataam.com/glossary/statement-of-applicability/ — What is Statement of Applicability? Definition, How It Works & FAQ — A Statement of Applicability (SoA) is the ISO 27001 and ISO 42001 document that lists every Annex A control and records whether each one is applicable or e… - https://cataam.com/glossary/trust-center/ — What is Trust Center? Definition, How It Works & FAQ — A trust center is a public-facing page where an organization shares its security posture, certifications, and supporting documentation so prospects and cus… - https://cataam.com/glossary/trust-services-criteria/ — What is Trust Services Criteria? Definition, How It Works & FAQ — Trust Services Criteria (TSC) are the five control criteria defined by the AICPA that a SOC 2 examination evaluates: Security, Availability, Processing Int… - https://cataam.com/glossary/vendor-risk-management/ — What is Vendor Risk Management? Definition, How It Works & FAQ — Vendor risk management is the practice of assessing and continuously monitoring the security and compliance posture of the third-party suppliers an organiz… - https://cataam.com/glossary/vulnerability-management/ — What is Vulnerability Management? Definition, How It Works & FAQ — Vulnerability management is the ongoing process of identifying, prioritizing, and remediating security weaknesses across an organization's systems and soft… - https://cataam.com/glossary/zero-trust/ — What is Zero Trust? Definition, How It Works & FAQ — Zero Trust is a security model built on the principle never trust, always verify. It grants no implicit trust based on network location, treating every use… - https://cataam.com/legal/aup/ — Acceptable Use Policy (AUP) — CATAAM Acceptable Use Policy — permitted and prohibited uses of the CATAAM platform, including security scanning, data handling and integrations. - https://cataam.com/legal/dpa/ — Data Protection Addendum (DPA) — CATAAM Data Protection Addendum — a GDPR Article 28 processor agreement covering processing details, security measures, sub-processors and data subject rights. - https://cataam.com/okf/ — OKF — the Open Knowledge Format Standard for AI & Claude — OKF (Open Knowledge Format) is the open, AI-readable standard for packaging knowledge as a linked graph — see how it works with Claude via MCP, no lock-in. - https://cataam.com/partner-program/ — Partner Program — CATAAM CISO Reseller and CPA Partner Program — manage unlimited client organizations, bill post-paid at $149/framework/month, and grow your compliance practice. - https://cataam.com/press/ — Newsroom & Press Releases — Official CATAAM announcements — product, pricing, and company news for the unified compliance, attack-surface management, and breach-simulation platform. - https://cataam.com/press/cataam-adds-australian-privacy-act-and-apra-cps-234/ — CATAAM Adds Support for Australia’s Privacy Act (APPs) and APRA CPS 234 — CATAAM extends its Australian compliance coverage with the Australian Privacy Principles and APRA’s CPS 234 information-security standard — joining the Essen… - https://cataam.com/press/cataam-adopts-open-knowledge-format/ — CATAAM Becomes the First GRC and Security Platform to Adopt Google’s Open Knowledge Format — The new OKF Context Engine compiles an organization’s entire compliance program into an open, portable, AI-readable bundle — read natively by Claude via MCP… - https://cataam.com/press/cataam-launches-value-based-pricing/ — CATAAM Launches Value-Based Pricing and a New Business Tier — Unified compliance, attack-surface management, and breach-and-attack simulation across four tiers — still well below the cost of stitching together separate… - https://cataam.com/pricing/ — Pricing — Compliance automation from $149/mo — SOC 2, ISO 27001, PCI-DSS & GDPR plus iASM & BAS in one platform, about 50% below Vanta & Drata. Free attack-surface tier. - https://cataam.com/privacy-policy/ — Privacy Policy — CATAAM Privacy Policy — how TheMarkups Canada Inc. collects, uses, and protects your data. - https://cataam.com/prompt-guard/ — Prompt Guard — Keep Secrets Out of Public LLMs | Open Source by CATAAM — Open-source, local-first prompt hygiene. Reversibly redact secrets and PII before they reach ChatGPT, Claude or Gemini, with ISO 42001 / EU AI Act evidence. - https://cataam.com/refund-policy/ — Refund Policy — CATAAM Refund and Cancellation Policy — subscription cancellation, credit refunds, and billing terms. - https://cataam.com/report/ — Certified ≠ Secure — The Attack-Surface Study (1,171 organizations) — A free anonymized study of 1,171 organizations: the organizations advertising compliance certifications were MORE externally fragile, not less. Get the Fragility Index, the compliance paradox, and the weakness patterns. - https://cataam.com/resources/australian-privacy-principles-checklist/ — Australian Privacy Principles Checklist — 13 APPs (Free) — Free Australian Privacy Principles compliance checklist — all 13 APPs plus the Notifiable Data Breaches scheme, obligation by obligation, with status, evidence and owner columns. Download the CSV, no signup. - https://cataam.com/resources/dpdp-compliance-checklist/ — DPDP Act Compliance Checklist (India) — Free — Free Digital Personal Data Protection (DPDP) Act 2023 compliance checklist — notice & consent, Data Principal rights, Data Fiduciary obligations, children’s data and cross-border, with status columns. Download the CSV, no signup. - https://cataam.com/resources/essential-eight-maturity-assessment-template/ — Essential Eight Maturity Assessment Template (Free) — Free Essential Eight maturity assessment template — a worksheet covering all eight ACSC mitigation strategies across Maturity Levels 1–3, with status, evidence and owner columns. Download the CSV, no signup. - https://cataam.com/resources/hipaa-security-rule-checklist/ — HIPAA Security Rule Checklist — Safeguards (Free) — Free HIPAA Security Rule compliance checklist — every Administrative, Physical and Technical safeguard (Required and Addressable), plus breach notification, with status and evidence columns. Download the CSV, no signup. - https://cataam.com/resources/iso-27001-statement-of-applicability-template/ — ISO 27001 Statement of Applicability (SoA) Template — Free — Free ISO/IEC 27001:2022 Statement of Applicability (SoA) template — all four Annex A themes, applicability, justification and implementation-status columns, including the 11 new 2022 controls. Download the CSV, no signup. - https://cataam.com/resources/iso27001-risk-assessment-template/ — ISO 27001 Risk Assessment Template (2022) — Free — Free ISO 27001:2022 risk assessment template — scoring methodology (likelihood × impact), risk-treatment options, and an asset and risk register structure. - https://cataam.com/resources/notifiable-data-breach-response-plan/ — Notifiable Data Breach Response Plan Template (Free) — Free Notifiable Data Breach (NDB) response plan template, aligned to the Privacy Act 1988 and OAIC guidance — the four steps (contain, assess, notify, review), roles, timeframes and a decision record. Download the Markdown, no signup. - https://cataam.com/resources/pci-dss-compliance-checklist/ — PCI DSS Compliance Checklist — 12 Requirements (Free) — Free PCI DSS v4.0 compliance checklist — all 12 requirements across the 6 goals, plus SAQ scoping, with status and evidence columns. Download the CSV, no signup. - https://cataam.com/resources/security-glossary/ — Security & GRC Glossary — Compliance Terms — Plain-English definitions of security, GRC and compliance terms — SOC 2, ISO 27001, BAS, iASM, RBAC, MFA, CVSS, POA&M and more. A jargon-free glossary. - https://cataam.com/resources/soc2-evidence-checklist/ — SOC 2 Evidence Checklist (Type II) by Control — Free SOC 2 Type II evidence checklist organized by Common Criteria (CC1-CC9) — exactly what auditors ask for, control by control. Prep your audit faster. - https://cataam.com/scan/ — Free Attack Surface Snapshot — Certified ≠ Secure. Scan your own attack surface in minutes — get your Fragility score, severity counts, and top weakness categories, and see where you rank against 1,171 organizations. Passive, external, no agent. - https://cataam.com/solutions/automate-soc2-evidence-collection/ — Automate SOC 2 Evidence Collection (2026) — Auto-collect & map SOC 2 evidence from AWS, GitHub & Jira to every Trust Services control — continuously, validated by built-in security testing. From $149/mo. - https://cataam.com/solutions/continuous-control-monitoring/ — Continuous Control Monitoring Software — Continuous control monitoring for SOC 2, ISO 27001, HIPAA & PCI-DSS — CATAAM auto-re-checks controls and alerts on drift to keep you audit-ready year-round. - https://cataam.com/terms/ — Terms of Service — CATAAM Terms of Service — usage terms, subscription conditions, and policies for TheMarkups Canada Inc. products. - https://cataam.com/tools/ — Free Security & Compliance Tools — Free tools for security and compliance teams — an SPF/DMARC/DKIM email security checker, a compliance cost calculator for SOC 2 & ISO 27001, and more. No signup. - https://cataam.com/tools/ai-governance-readiness/ — AI Governance & ISO 42001 Readiness Assessment (Free) — Free AI governance readiness assessment for ISO/IEC 42001 and the EU AI Act. Answer a short checklist and get an instant AI governance score, your gap list, and what to fix first. No signup. - https://cataam.com/tools/australian-privacy-act-assessment/ — Australian Privacy Act Assessment — APP & NDB (Free) — Free Australian Privacy Act readiness assessment. Score yourself against all 13 Australian Privacy Principles (APPs) and the Notifiable Data Breaches scheme, get an instant readiness score, your gaps, and what to fix first. No signup. - https://cataam.com/tools/compliance-cost-calculator/ — Compliance Cost Calculator (2026) — SOC 2, ISO 27001, HIPAA, PCI — Free compliance cost calculator. Estimate your first-year SOC 2, ISO 27001, HIPAA or PCI-DSS cost — auditor, tooling, time — vs automation from $149/mo. - https://cataam.com/tools/email-security-checker/ — Free Email Security Checker — SPF, DMARC & DKIM — Free SPF, DMARC and DKIM checker. Enter your domain and instantly see whether attackers can spoof your email — with a plain-English grade and fixes. No signup, runs in your browser. - https://cataam.com/tools/essential-eight-assessment/ — Essential Eight Maturity Assessment (Free Tool) — Free Essential Eight maturity self-assessment. Rate your organisation across all eight ACSC mitigation strategies and get your overall Maturity Level (0–3), a per-strategy breakdown, and what to fix first. No signup. - https://cataam.com/tools/soc2-readiness-assessment/ — SOC 2 & ISO 27001 Readiness Assessment (Free) — Free SOC 2 and ISO 27001 readiness assessment. Answer a short control-by-control checklist and get an instant readiness score, your gap list, and what to fix first. No signup. ## Glossary definitions ### SOC 2 — https://cataam.com/glossary/soc-2/ SOC 2 is an attestation report, defined by the AICPA, that evaluates how a service organization protects customer data against five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. An independent CPA firm issues the report, making it the standard proof of security posture for SaaS and cloud vendors in North America. ### SOC 2 Type II — https://cataam.com/glossary/soc-2-type-2/ SOC 2 Type II is a SOC 2 report that evaluates whether a service organization's controls not only are designed appropriately but also operate effectively over a defined observation period, typically three to twelve months. It is the more rigorous and widely demanded form of SOC 2, because it proves controls work continuously rather than at a single moment. ### ISO 27001 — https://cataam.com/glossary/iso-27001/ ISO 27001 is the international standard for an information security management system (ISMS), published by ISO and IEC. It defines requirements for systematically identifying, treating, and monitoring information security risks, and is the basis for accredited certification recognized worldwide. The 2022 revision lists 93 Annex A controls across four themes. ### ISO 42001 — https://cataam.com/glossary/iso-42001/ ISO 42001 is the world's first international standard for an artificial intelligence management system (AIMS), published in 2023 by ISO and IEC. It defines requirements for governing the responsible development and use of AI, including an AI impact assessment, and is certifiable by an accredited registrar. Annex A provides 38 controls across nine objectives. ### HIPAA — https://cataam.com/glossary/hipaa/ HIPAA is the US federal law that sets national standards for protecting individuals' health information. Enforced by the HHS Office for Civil Rights, it governs how covered entities and their business associates safeguard protected health information (PHI) through its Privacy, Security, and Breach Notification Rules. Compliance is mandatory for organizations handling US health data. ### PCI DSS — https://cataam.com/glossary/pci-dss/ PCI DSS is the Payment Card Industry Data Security Standard, a set of security requirements that any organization storing, processing, or transmitting payment card data must meet. Maintained by the PCI Security Standards Council, its current major version is v4.0. Validation ranges from a self-assessment questionnaire to a full on-site audit by a Qualified Security Assessor. ### GDPR — https://cataam.com/glossary/gdpr/ GDPR is the European Union's General Data Protection Regulation, a comprehensive data-protection law governing how personal data of individuals in the EU and EEA is collected, processed, and protected. It applies to any organization worldwide that targets or monitors EU residents, grants individuals strong rights over their data, and carries significant penalties for violations. ### NIST Cybersecurity Framework — https://cataam.com/glossary/nist-csf/ The NIST Cybersecurity Framework (NIST CSF) is a voluntary framework from the US National Institute of Standards and Technology that helps organizations manage and reduce cybersecurity risk. Its 2.0 version is organized around six core functions - Govern, Identify, Protect, Detect, Respond, and Recover - and is widely used across industries to structure security programs. ### NIST AI RMF — https://cataam.com/glossary/nist-ai-rmf/ NIST AI RMF (AI Risk Management Framework) is a voluntary US framework published by the National Institute of Standards and Technology to help organizations identify, measure, and manage the risks of designing, developing, and deploying AI systems. It is organized around four functions: Govern, Map, Measure, and Manage. ### FedRAMP — https://cataam.com/glossary/fedramp/ FedRAMP (Federal Risk and Authorization Management Program) is a US government program that standardizes the security assessment, authorization, and continuous monitoring of cloud products and services used by federal agencies. Built on NIST SP 800-53 controls, it lets a cloud service earn an authorization that agencies can reuse rather than assessing each provider independently. ### CMMC — https://cataam.com/glossary/cmmc/ CMMC (Cybersecurity Maturity Model Certification) is a US Department of Defense program that verifies defense contractors and subcontractors have adequate cybersecurity to protect sensitive government information. CMMC 2.0 defines three levels and is built largely on NIST SP 800-171, protecting Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). ### HITRUST — https://cataam.com/glossary/hitrust/ HITRUST is a certifiable security and privacy framework, delivered through the HITRUST CSF, that harmonizes requirements from HIPAA, ISO 27001, NIST, PCI DSS, and other standards into a single control set. Widely adopted in healthcare, it lets an organization demonstrate compliance against many overlapping mandates through one certification. ### ISO 27701 — https://cataam.com/glossary/iso-27701/ ISO 27701 is an international standard that extends ISO 27001 and ISO 27002 with requirements for a Privacy Information Management System (PIMS). It adds privacy-specific controls for organizations acting as data controllers or processors and maps closely to regulations such as the GDPR, turning an existing security management system into a privacy management system. ### EU AI Act — https://cataam.com/glossary/eu-ai-act/ The EU AI Act is the European Union's comprehensive, risk-based regulation governing artificial intelligence. It classifies AI systems by risk — unacceptable (banned), high-risk, limited, and minimal — imposing the strictest obligations on high-risk uses, and adds specific rules for general-purpose AI models. It applies to providers and deployers whose AI affects the EU market. ### Trust Services Criteria — https://cataam.com/glossary/trust-services-criteria/ Trust Services Criteria (TSC) are the five control criteria defined by the AICPA that a SOC 2 examination evaluates: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security — the common criteria — is always included, while the other four are optional categories an organization selects based on its commitments to customers. ### ISMS — https://cataam.com/glossary/isms/ An ISMS (Information Security Management System) is the structured set of policies, procedures, roles, and controls an organization uses to manage information security risk. It is the thing ISO 27001 certifies. An ISMS treats security as an ongoing, risk-driven program rather than a one-time project. ### AIMS — https://cataam.com/glossary/aims/ An AIMS (AI Management System) is the structured set of policies, processes, roles, and controls an organization uses to govern the responsible development and use of artificial intelligence. It is the system that ISO 42001 certifies. An AIMS extends management-system thinking to AI-specific risks like bias, transparency, and oversight. ### Statement of Applicability — https://cataam.com/glossary/statement-of-applicability/ A Statement of Applicability (SoA) is the ISO 27001 and ISO 42001 document that lists every Annex A control and records whether each one is applicable or excluded, the justification for that decision, and its implementation status. It is the cornerstone document an auditor reviews to understand the ISMS at a glance. ### Annex A Controls — https://cataam.com/glossary/annex-a-controls/ Annex A controls are the catalog of security or AI controls listed in the annex of an ISO management-system standard. ISO 27001:2022 defines 93 controls across 4 themes, while ISO 42001 defines 38 controls across 9 objectives. Organizations select from this catalog based on their risk assessment and record their choices in the Statement of Applicability. ### Risk Assessment — https://cataam.com/glossary/risk-assessment/ A risk assessment is the process of identifying assets, threats, and vulnerabilities, then scoring each risk by its likelihood and impact. It is the analytical core of an ISMS, and ISO 27001 clause 6 requires it to follow a repeatable, documented method. Its output drives which controls an organization implements. ### Risk Treatment — https://cataam.com/glossary/risk-treatment/ Risk treatment is the process of deciding how to handle each risk identified in a risk assessment, by mitigating, accepting, transferring, or avoiding it. Whatever risk remains after treatment is the residual risk. The decisions are recorded in a risk treatment plan that drives control selection. ### Gap Analysis — https://cataam.com/glossary/gap-analysis/ A gap analysis compares an organization's current controls against the requirements of a framework to identify what is missing before an audit. It produces a prioritized list of gaps and remediation work. It is typically the first step on the road to certification or attestation. ### Attestation — https://cataam.com/glossary/attestation/ An attestation is a CPA firm's formal opinion on whether an organization's controls are designed and operating as described, most commonly delivered as a SOC 2 report. It differs from certification, where an accredited body certifies conformance to a standard like ISO 27001. An attestation is an auditor's opinion, not a pass-or-fail certificate. ### Evidence Collection — https://cataam.com/glossary/evidence-collection/ Evidence collection is the process of gathering proof that security and compliance controls actually operate as intended. This proof includes system configurations, logs, screenshots, policy documents, and tickets that an auditor reviews to confirm a control is both designed correctly and operating effectively over time. ### Continuous Control Monitoring — https://cataam.com/glossary/continuous-control-monitoring/ Continuous control monitoring (CCM) is the practice of automatically and continuously testing whether controls operate correctly, then surfacing an alert as soon as a control falls out of compliance. It replaces point-in-time checks with always-on assurance, so issues surface long before an annual audit rather than during one. ### Compensating Control — https://cataam.com/glossary/compensating-control/ A compensating control is an alternative safeguard used when an organization cannot implement a required control, but still needs to meet the intent of that requirement. It must provide a comparable level of protection and be formally documented and justified. Compensating controls are most familiar from PCI DSS, where they follow a strict approval process. ### Residual Risk — https://cataam.com/glossary/residual-risk/ Residual risk is the risk that remains after controls and other treatments have been applied. No safeguard eliminates risk entirely, so a measurable amount persists, and leadership must formally decide to accept, further treat, or transfer it. Documenting and accepting residual risk is a core requirement of risk-based frameworks like ISO 27001. ### Internal Audit — https://cataam.com/glossary/internal-audit/ An internal audit is a self-assessment an organization performs on its own management system before an external certification or examination. Its purpose is to find nonconformities and gaps so they can be fixed first. In ISO 27001, internal audits are a mandatory, recurring requirement under clause 9.2 of the standard. ### Vendor Risk Management — https://cataam.com/glossary/vendor-risk-management/ Vendor risk management is the practice of assessing and continuously monitoring the security and compliance posture of the third-party suppliers an organization relies on. It typically involves collecting vendors' audit reports, evaluating their access to data, and reassessing them on a periodic basis, because a vendor's weakness can become your breach. ### Access Review — https://cataam.com/glossary/access-review/ An access review is a periodic check that each user's permissions still match what their role actually requires. By confirming and revoking access on a recurring basis, organizations enforce least privilege and catch the over-permissioned or orphaned accounts that accumulate over time. Access reviews are a standard control across SOC 2, ISO 27001, and other frameworks. ### Segregation of Duties — https://cataam.com/glossary/segregation-of-duties/ Segregation of duties (SoD) is the practice of splitting a critical task across multiple people so that no single individual can complete a sensitive action alone. By requiring more than one person, it reduces the chance of fraud and error and creates a natural check on powerful actions. SoD is a foundational control in both security and financial compliance. ### Trust Center — https://cataam.com/glossary/trust-center/ A trust center is a public-facing page where an organization shares its security posture, certifications, and supporting documentation so prospects and customers can perform due diligence on their own. By centralizing audit reports, policies, and subprocessor lists, a trust center reduces repetitive security questionnaires and accelerates sales and procurement. ### Attack Surface Management — https://cataam.com/glossary/attack-surface-management/ Attack Surface Management (ASM) is the continuous discovery, inventory, and monitoring of an organization's internet-facing assets that an attacker could target. It takes an outside-in view, mapping every exposed domain, IP, service, and certificate so security teams can find and fix exposures before adversaries reach them. ### Internal Attack Surface Management — https://cataam.com/glossary/internal-attack-surface-management/ Internal Attack Surface Management (iASM) is the discovery and mapping of internal cloud and identity assets and the attack paths between them. It takes an inside-out view, modeling what an attacker could reach after gaining a foothold, so teams can find and cut the chains that lead to high-value targets. ### Breach and Attack Simulation — https://cataam.com/glossary/breach-and-attack-simulation/ Breach and Attack Simulation (BAS) is the practice of safely emulating real adversary techniques to validate whether security controls detect and stop them. BAS is continuous and automated, typically maps each test to MITRE ATT&CK, and produces evidence of which defenses actually work rather than which merely exist. ### Penetration Testing — https://cataam.com/glossary/penetration-testing/ Penetration testing is an authorized, simulated attack carried out by skilled humans to find and exploit vulnerabilities in a system. It is point-in-time and creativity-driven, going beyond scanning to prove what an attacker could actually achieve. Many frameworks, including PCI DSS and SOC 2, expect periodic penetration testing. ### MITRE ATT&CK — https://cataam.com/glossary/mitre-attack/ MITRE ATT&CK is a free, globally used knowledge base of real-world adversary tactics and techniques observed in actual intrusions. It gives offense and defense a common language for describing how attackers operate, and is widely used to plan testing, measure detection coverage, and map findings to known behaviors. ### Attack Path — https://cataam.com/glossary/attack-path/ An attack path is the chain of steps an attacker takes, from an initial foothold through exploitation and pivoting, to reach a high-value target. It combines privilege escalation and lateral movement to show real blast radius, revealing not just isolated weaknesses but how they connect into a route to crown-jewel assets. ### Privilege Escalation — https://cataam.com/glossary/privilege-escalation/ Privilege escalation is the act of gaining higher access than you started with, such as moving from a standard user to an administrator. It is a key step in most attack paths, letting an intruder turn a limited foothold into broad control. It is mitigated primarily by least privilege and regular access reviews. ### Lateral Movement — https://cataam.com/glossary/lateral-movement/ Lateral movement is the set of techniques an attacker uses to move from an initially compromised system to other systems inside a network, hunting for the credentials, data, or privileges needed to reach a final objective. It is constrained by network segmentation, least privilege, and zero-trust controls. ### Vulnerability Management — https://cataam.com/glossary/vulnerability-management/ Vulnerability management is the ongoing process of identifying, prioritizing, and remediating security weaknesses across an organization's systems and software. It is a continuous cycle rather than a one-time scan, and it relies on standardized CVE identifiers and CVSS severity scores to track and rank issues. ### CVE — https://cataam.com/glossary/cve/ CVE stands for Common Vulnerabilities and Exposures, a system that assigns a unique identifier to each publicly disclosed cybersecurity vulnerability. A CVE record uses the format CVE-YYYY-NNNNN and is maintained by the CVE Program, giving the security community a common reference for naming and tracking flaws. ### CVSS — https://cataam.com/glossary/cvss/ CVSS, the Common Vulnerability Scoring System, is an open framework for rating the severity of software vulnerabilities on a numerical scale from 0.0 to 10.0. Maintained by FIRST, it translates a vulnerability's technical characteristics into a score and a severity rating such as Low, Medium, High, or Critical. ### Zero Trust — https://cataam.com/glossary/zero-trust/ Zero Trust is a security model built on the principle never trust, always verify. It grants no implicit trust based on network location, treating every user, device, and connection as untrusted until proven otherwise through continuous verification of identity, enforcement of least privilege, and segmentation. ### Least Privilege — https://cataam.com/glossary/least-privilege/ Least privilege is the security principle of granting every user, account, and process only the access it genuinely needs to perform its function, and no more. By minimizing standing permissions, it shrinks the attack surface and limits the damage that any single compromised account can cause. ### Security Posture — https://cataam.com/glossary/security-posture/ Security posture is the overall strength of an organization's cybersecurity at a given point in time, reflecting the state of its controls, its exposure to threats, and its ability to detect and respond to attacks. Because it changes constantly, it is best understood and proven through continuous monitoring and active testing. ### AI Impact Assessment — https://cataam.com/glossary/ai-impact-assessment/ An AI impact assessment is a structured evaluation of how an AI system affects individuals, groups, and society, including risks to rights, fairness, safety, and wellbeing. It is a core requirement of ISO 42001 and supports conformity efforts under regulations such as the EU AI Act. ### Responsible AI — https://cataam.com/glossary/responsible-ai/ Responsible AI, also called trustworthy AI, is the practice of developing and using AI systems that are fair, transparent, accountable, safe, and respectful of privacy. It moves beyond principles into operation through frameworks such as ISO 42001 and the NIST AI Risk Management Framework. ### Open Knowledge Format — https://cataam.com/glossary/open-knowledge-format/ Open Knowledge Format, or OKF, is an open, vendor-neutral standard for packaging information as graph-linked Markdown that AI agents can read natively. Rather than locking knowledge inside proprietary systems, OKF structures it so that tools like AI assistants can traverse and reason over it directly. ### DPDP Act — https://cataam.com/glossary/dpdp-act/ The Digital Personal Data Protection (DPDP) Act, 2023 is India's national data-protection law. It governs the processing of digital personal data of individuals (data principals) in India on a consent-first basis, grants individuals rights over their data, obliges organizations (data fiduciaries) to protect it, and is enforced by the Data Protection Board of India with penalties up to ₹250 crore per instance. ### SOC 1 — https://cataam.com/glossary/soc-1/ SOC 1 is an attestation report, defined by the AICPA under SSAE 18, that evaluates a service organization's controls relevant to its customers' internal control over financial reporting (ICFR). It is requested by customers whose financial statements are affected by the services they buy - such as payroll, payments, or billing platforms - and their auditors. ### SOC 2 Type I — https://cataam.com/glossary/soc-2-type-1/ SOC 2 Type I is a SOC 2 report that evaluates whether a service organization's controls are suitably designed to meet the relevant Trust Services Criteria at a single point in time. It is faster to obtain than a Type II and is often used as a first, credible security proof while the observation period for a Type II accrues. ### Business Associate Agreement — https://cataam.com/glossary/business-associate-agreement/ A Business Associate Agreement (BAA) is a HIPAA-required contract between a covered entity (or a business associate) and a vendor that creates, receives, maintains, or transmits protected health information (PHI) on its behalf. The BAA binds the vendor to safeguard PHI, limits how it may be used, and sets breach-notification and other obligations. ### Data Processing Agreement — https://cataam.com/glossary/data-processing-agreement/ A Data Processing Agreement (DPA) is a contract between a data controller and a data processor that governs how the processor may handle personal data on the controller's behalf. Required by GDPR Article 28 and echoed in laws like India's DPDP Act, it sets the scope, purpose, security measures, sub-processing rules, and data-return/deletion obligations. ### Data Subject Access Request — https://cataam.com/glossary/data-subject-access-request/ A Data Subject Access Request (DSAR) is a request by an individual to exercise their rights over their personal data - most commonly to access a copy of the data an organization holds about them, but also to correct, delete, or port it. Privacy laws such as GDPR and India's DPDP Act give individuals these rights and set deadlines for organizations to respond.