Compliance
The frameworks, checked on your clouds
Every Ctadel rule cites the controls of the frameworks it covers. These pages say, framework by framework, what is checked and what is not.
- ISO 27001, checked on your clouds at every scanAnnex A of ISO/IEC 27001:2022 requires controls on access, encryption, logging, configuration and vulnerability management. Ctadel checks them on your six clouds and cites the control on every finding.
- SOC 2, technical evidence at every scanA SOC 2 report requires proving that security controls work over time. Ctadel continuously checks the configuration, access and vulnerabilities of your clouds, and cites the criterion on every finding.
- PCI DSS v4.0, checked on the cardholder data environmentPCI DSS requires strict segmentation, encryption, restricted access and documented vulnerability management. Ctadel checks these requirements on your clouds and cites the requirement number on every finding.
- NIST SP 800-53, control by controlThe AC, AU, CM, IA, SC and SI families of NIST SP 800-53 rev. 5 cover access, audit, configuration, identification, communications protection and integrity. Ctadel checks them on your clouds and cites the control on every finding.
- GDPR: where personal data is, and who can reach itArticle 32 requires appropriate technical measures: encryption, confidentiality, resilience. Before proving them, you need to know where the data is. Ctadel spots it in your buckets and databases, then shows who reaches it and by which path.
- HIPAA: technical safeguards, checked at every scanThe HIPAA Security Rule requires technical safeguards on access, audit, integrity and transmission of health data. Ctadel spots that data in your clouds and checks the protections around it.
- SecNumCloud: a qualified cloud, and a configuration that holdsA SecNumCloud-qualified host does not guarantee the configuration of what you deploy on it. Ctadel inspects your resources on OUTSCALE, Scaleway and OVHcloud and cites the technical requirements of the 3.2 framework on the findings concerned.
- CIS Benchmarks, from the cloud account to the operating systemThe CIS Benchmarks describe a hardened configuration, control by control. Ctadel applies them to AWS and Azure accounts, to Linux and Windows hosts read from a disk copy, and to Kubernetes clusters.
Reports per framework are under internal validation. Ctadel claims no certification for itself.
See it on your accounts
The online demonstration is open to all, on fictitious data. For an instance on your own accounts, request a demonstration.