Compliance

Onam's Compliance engine turns raw security findings into audit-ready compliance posture: every finding is mapped to the controls it violates across 70+ regulatory frameworks, every control gets a pass rate computed from live scan data, and every framework gets a 0–100 score you can track, export, and hand to an auditor.

This page explains how the mapping works, how per-control pass rates and framework scores are computed, and how to generate reports. For the full framework catalog and per-framework coverage tables, see Framework Coverage.

From Findings to Scores

Compliance runs as a pipeline stage after every scan: the Check engine and the domain engines (network, data, container, IAM) produce findings, and the Compliance engine aggregates them into control-level evidence. No separate "compliance scan" is needed — the same scan that finds a public bucket also updates your PCI-DSS score.

1. Load. The engine reads every finding from the completed scan run — misconfigurations, plus domain findings from data security, network, container, and IAM.
2. Map. Each rule ID is resolved against the rule-to-control mapping catalog. One rule typically cites controls in several frameworks at once, so a single check produces evidence for many frameworks simultaneously.
3. Aggregate. Findings are grouped by framework, control, and resource, and pass/fail counts are computed per control.
4. Score. Per-control pass rates roll up into a weighted 0–100 compliance score per framework.
5. Report. The reporter assembles deduplicated findings, evidence, and asset snapshots into a stored report; exporters produce JSON, CSV, Excel, and PDF.

Control Mapping

The mapping catalog links each of Onam's 10,000+ rules to the specific controls it evidences. Because the mapping is many-to-many, one failed check propagates to every framework that cares about it:

Every finding detail page in the console shows its full list of framework citations, and every control page lists the exact resources that passed and failed.

Pass Rates and Scores

Each control's pass rate is computed from the resources evaluated against it in the latest scan:

The framework score (0–100) is a weighted rollup of its control pass rates. Scores are recomputed on every scan and recorded historically, so the trends view shows whether posture is improving release over release — per framework, per account, and per cloud.

Automated scanning evaluates technical controls — encryption, logging, access policies, network exposure. Frameworks also contain administrative and process controls (security training, vendor management) that no scanner can assess. Framework reports mark which controls are auto-assessed so auditors see exactly what the score covers.

Framework Catalog

The catalog covers 70+ frameworks, including CIS Benchmarks (AWS, Azure, GCP — multiple versions), NIST CSF 2.0, NIST 800-53 R4/R5, NIST 800-171, PCI-DSS v4.0/4.0.1, HIPAA and HITRUST CSF v11.3, ISO 27001/27002/27017 (2022), SOC 2, GDPR, NIS2, the EU AI Act, DORA, FedRAMP High and Moderate, CMMC 2.0 L2/L3, SWIFT CSCF, RBI ITF, APRA CPS 234, UK NCSC CAF, Cyber Essentials, LGPD, SOX, and CSA CCM v4.

Representative control counts:

The full list with per-framework coverage tables is on Framework Coverage. Custom rules built in the Rule Builder carry their own framework mappings, so organization-specific policies feed the same scores.

Reports and Exports

Four report shapes cover the audiences that consume compliance data:

All reports export as PDF, Excel, CSV, and JSON. You can scope any report to specific frameworks, cloud accounts, or providers, and optionally include passing controls for full-evidence audits.

Running Compliance Reports

Reports generate automatically after every scheduled scan. You can also generate ad-hoc reports at any time — pick a scan run, select frameworks, and export:

1. Open Compliance in the Onam console and select a framework.
2. Review the per-control breakdown — each failed control lists its failing resources and the finding that caused the failure.
3. Fix findings (or suppress with justification) and re-scan; the score updates on the next run.
4. Export the framework report as PDF or Excel for evidence.

API

# List all supported frameworks with metadata
GET /api/v1/compliance/frameworks

# Full report for one framework
GET /api/v1/compliance/framework/{framework_id}/report

# Executive dashboard across frameworks
GET /api/v1/compliance/dashboard

# Historical score trends
GET /api/v1/compliance/trends

Report exports accept a format parameter (pdf, csv, excel, or json). Full schemas are in the API reference.

FAQ

How often do scores update? After every scan (typically daily), plus whenever you trigger an ad-hoc scan. Every score snapshot is retained for trend reporting.

Can I score a single account or business unit? Yes. Reports scope by cloud account, provider, or account group — useful when different business units are audited against different frameworks.

Do custom rules affect compliance scores? Yes, when you assign framework mappings to them in the Rule Builder. Unmapped custom rules produce findings but do not change framework scores.

Is a 100 score the same as being certified? No. The score means every automatically-assessed technical control passed in the latest scan. Certification also requires process controls and an accredited auditor — Onam's exports are designed to be the technical-evidence package for that audit.

Next steps

• Framework Coverage — the full 70+ framework catalog with coverage tables
• CSPM — the rule registry that generates the underlying findings
• Data Security — where GDPR / PCI / HIPAA data findings come from
• Book a demo — see your framework scores on a live connected account