Evaluate the control once. Report it against every framework.
Compliance work is mostly duplication: the same control, re-checked and re-evidenced for PCI, then SOC 2, then ISO, then a customer questionnaire. Onam removes the duplication by decoupling the check from the framework. Rules are evaluated once as code; a single finding maps to many controls across 78 frameworks at once.
This paper explains the mapping model, why rules-as-code makes framework coverage extend automatically, and how compliance and attack-path reasoning reinforce each other — so a control gap is not just a failed check but, where it applies, a step on an attack path.
Frameworks disagree about wording far more than they disagree about controls.
A framework is, at bottom, a set of controls. Many controls across many frameworks ask for the same underlying thing — "encrypt data at rest", "restrict public access", "enforce MFA". Onam evaluates that underlying condition once and maps the result to every control it satisfies or violates.
A new rule extends every framework it maps to, and a new framework inherits every rule already written.
Onam's rules are versioned YAML the platform loads and evaluates; nothing is hardcoded. This is what makes framework coverage compound rather than accumulate by hand. When a new rule is added, it automatically extends every framework whose controls it maps to. When a new framework is onboarded, its controls map to existing rule IDs — no new checks to write.
Coverage here means continuous evaluation, not an audit export generated the week before.
Onam supports 78 frameworks out of the box across regulatory, industry and best-practice standards — for example PCI DSS v4.0.1, SOC 2, ISO 27001:2022, HIPAA, GDPR, NIST 800-53, NIST 800-171, FedRAMP Moderate and High, and CIS benchmarks. Coverage is delivered as continuous evaluation, not a point-in-time audit export.
The mapping rests on a catalog of 11,433 rule definitions across 7 clouds and 549 cloud services, of which 9,853 are CSPM posture rules.
Two control failures of equal audit weight are not equal risk.
A failed control is a compliance fact. The same failing condition is also a node in the property graph — and Onam records on each resource whether it sits on an attack path and whether it is a choke point — so a failed control can be read alongside whether its failure lies on a confirmed route to a crown jewel. That reframes remediation: two "failures" of equal audit weight are not equal if one sits on a choke point and the other reaches nothing.
| Lens | Question it answers | What it ranks by |
|---|---|---|
| Compliance | Which controls are failing, and where is the evidence? | Framework obligation |
| Risk | Which failure is on a reachable path to something that matters? | Attack-path signals and FAIR-style loss estimate |
Read together, the two lenses turn an audit backlog into an ordered queue: the control gaps that are also choke points come first, because fixing one of them closes an obligation and removes a route.
A large framework number proves breadth of mapping. It does not prove depth of evaluation, quality of evidence, or that the controls most relevant to your obligations are covered well.
Fix the condition once; every framework that maps to it updates itself.