Compliance Framework Coverage
The Onam platform maps security findings to the compliance frameworks you care about — 78 frameworks, including CIS benchmarks, NIST 800-53, NIST 800-171, PCI DSS, HIPAA, ISO 27001:2022, SOC 2, GDPR, FedRAMP and RBI. One finding can count against controls in many frameworks at once. This page covers how the mapping works, how controls and frameworks are scored, which frameworks are included, and how to export a report.
Instead of running a separate compliance scan for each framework, the platform evaluates every applicable rule once and projects the results into the framework views you need. A failing check on "S3 public access blocked" is reflected in every framework that maps a control to it — one fix, several compliance gains.
How compliance mapping works
A single platform rule can evidence controls in many frameworks at the same time. When a resource passes or fails a rule, that result updates every framework mapped to it, on every compliance run. There is no separate "PCI scan" or "HIPAA scan" to schedule.
The three-layer model:
- Rules — each rule is a YAML definition with a clear assertion (e.g. "S3 buckets must block public access"), versioned in the catalog.
- Controls — every framework has its own control catalog (CIS sections, NIST control families, PCI requirements). The platform maintains a many-to-many rule-to-control mapping.
- Frameworks — a framework is a set of controls. Selecting a framework filters results to the rules mapped to its controls.
Findings come from four sources: posture checks, threat detection, vulnerabilities, and technology checks.
Scoring methodology
Framework scores are deterministic — no machine learning, no fuzzy logic. You can follow the math, and so can your auditor.
| Step | What is computed |
|---|---|
| 1. Evaluate | Every rule mapped to the framework runs against every in-scope resource |
| 2. Assess each control | Pass and fail counts across the rules mapped to the control give its status |
| 3. Framework score | Control results roll up into a 0–100% score for the framework |
| 4. Trend | Each score is kept, so you can show the trend for any framework |
Each control lands in one of five statuses:
| Status | Meaning |
|---|---|
| Pass | Every evaluated resource passed the mapped rules |
| Fail | Every evaluated resource failed |
| Partial | Some resources passed and some failed |
| Manual review | The control is a process or documentation control that needs a person to review it |
| Not applicable | No resources were evaluated against the control |
Exceptions are auditable. An exception or compensating control is recorded with a justification, an approver and a target date, stays visible in compliance views, and is flagged as its expiry nears.
Supported frameworks
The platform ships 78 frameworks:
| Group | Frameworks |
|---|---|
| CIS — clouds | CIS AWS (including versions 4.0.1, 5.0.0 and 6.0.0, plus compute, database, storage, EKS and end-user compute benchmarks) · CIS Azure (including compute, database, storage and AKS) · CIS GCP (including GKE, GKE Autopilot and Container-Optimized OS) · CIS OCI (including OKE) · CIS Alibaba Cloud (including ACK) · CIS IBM Cloud · CIS Kubernetes |
| CIS — technologies | Operating systems (Ubuntu, Debian, RHEL, CentOS, SUSE, VMware ESXi) · databases (PostgreSQL, MySQL, MariaDB, Microsoft SQL Server, Oracle Database, IBM Db2, MongoDB, Cassandra, Snowflake) · web and app servers (NGINX, Apache HTTP Server, Apache Tomcat, IIS, WebSphere) · network devices (Cisco ASA, Cisco Firewall, Cisco IOS XE, IOS XR, NX-OS, Palo Alto, FortiGate, Check Point) · containers and platforms (Docker, OpenShift) · SaaS (Microsoft 365, SharePoint, Dynamics 365, Google Workspace, GitLab) |
| US federal | NIST 800-53 · NIST 800-171 · FedRAMP Moderate · FedRAMP High · CISA CE |
| Standards and regulations | ISO 27001:2022 · SOC 2 · PCI DSS · HIPAA · GDPR |
| Regional | RBI (banks) · RBI (NBFCs) · Canada PBMM |
To request a framework, email hello@onamsecurity.com with the framework name and version.
Reports and evidence
Evidence is collected per control from the scan that produced the result — the resources evaluated, their results, and when the evidence was collected.
| Format | Best for |
|---|---|
| Hand-off to an auditor — executive summary and per-framework reports | |
| CSV | Spreadsheet review and GRC import |
| Excel | Per-framework workbooks |
| JSON | Programmatic use |
Every framework drills down from framework to control to resource, and compliance can be viewed per cloud account.
GET /api/v1/compliance/framework/{framework_id}/report
GET /api/v1/compliance/report/{report_id}/export?format=pdfCustom rules
Rules you build in the Rule Builder can carry their own framework mappings, so organisation-specific checks feed the same framework scores as built-in rules.
Frequently asked questions
Can I export a framework report for my auditor? Yes — PDF and CSV, plus Excel and JSON. Reports include an executive summary, control-by-control results and per-resource detail.
What happens to my compliance score between scans? Scores reflect the most recent compliance run. Start a scan on demand any time to refresh — see The scan pipeline.
What if a control doesn't apply to my environment? If no resources are evaluated against it, the control is marked not applicable. If it applies but you accept the risk, record an exception with a justification, an approver and a target date.
Can I track more than one version of a framework? Where the catalog includes several versions — CIS AWS, for example — each version is its own framework, so you can track them side by side.
Next steps
- The scan pipeline — how findings are produced before they become compliance evidence
- Architecture overview — the Compliance engine in the context of the platform
- Platform data security and tenancy — residency and isolation guarantees auditors ask about
- Book a demo — generate a framework report against a live demo account