Frameworks

Every rule in the catalogue carries a list of references to security frameworks. These references let you read a finding in the vocabulary of an audit, and they filter what the assistants take into account. They are not a certification, and Ctadel issues none.

The shape of a reference

A reference is a string of the form Framework:Control, for example ISO27001:A.8.20, NIST:SC-7, PCI-DSS:1.3, SOC2:CC6.6, GDPR:32, HIPAA:164.312(e)(1) or SecNumCloud:13. The part before the colon is the framework key; the part after is the control identifier within that framework. A reference without a colon, such as CIS, names the framework without a specific control.

Control identifiers follow the reference texts: Annex A of ISO/IEC 27001:2022, SOC 2 trust services criteria, PCI DSS v4.0 requirements, NIST SP 800-53 rev5 controls, GDPR articles, HIPAA Security Rule sections, chapters of the SecNumCloud 3.2 standard (9 access control and identities, 10 cryptology, 12 operations, 13 communications security, 14 acquisition and development, 17 continuity). Cost and sizing rules carry no reference.

Cloud configuration rules carry these references rule by rule. Kubernetes and host rules carry benchmark keys: CIS-K8s, PSS, CIS-RHEL, CIS-Ubuntu, CIS-Windows, CIS-Docker, CIS-Azure, STIG, OWASP, most often without a control identifier.

The frameworks the interface knows

The interface knows the following frameworks, with their display names:

Key	Display name	Subject
CIS	CIS Benchmarks	Configuration guidelines of the Center for Internet Security
CIS-K8s	CIS Kubernetes	CIS Benchmark for Kubernetes clusters
CIS-Docker	CIS Docker	CIS Benchmark for Docker
ISO27001	ISO 27001	Information security management systems
SOC2	SOC 2	Trust services criteria
GDPR	GDPR	General Data Protection Regulation
PCI-DSS	PCI DSS	Payment card data
NIST	NIST 800-53	NIST security controls
HIPAA	HIPAA	Healthcare data protection
SecNumCloud	SecNumCloud	ANSSI qualification of cloud providers, standard 3.2
PQC	PQC	Post-quantum cryptography readiness

A new instance records as enabled the frameworks CIS, CIS-AWS, CIS-EKS, CIS-K8s, CIS-Docker, ISO27001, SOC2, GDPR, PCI-DSS, NIST, HIPAA and SecNumCloud.

Where references appear

• In a finding's detail panel, the "Frameworks" section lists the rule's references as written, ISO27001:A.8.20 for example. A finding whose rule carries none does not show the section.
• In the rule catalogue, each rule keeps its list of references. When creating a custom rule, the "Compliance Frameworks" field offers the frameworks already present in the catalogue.
• In "Settings", the "Compliance Frameworks" card ("Enable compliance tracking for frameworks") shows one switch per recorded framework. Reading requires the "Read" permission of the "Settings" domain, changing requires "Update".

Disabling a framework changes neither the rules, nor the findings, nor the detail panel. The setting is read in two places: the per-framework coverage computed for the assistants, and the compliance page described below.

The compliance page

A compliance page, with a detail per framework and a printable version, computes for each enabled framework the share of controls whose rules all pass. This page is in internal validation and is not available to customers: it appears in the navigation only for accounts of the Ctadel team. The references in findings and the framework settings, on the other hand, are visible to everyone.

Limits

• The references are those written into the catalogue by Ctadel; they replace neither a mapping made by your auditor nor an official qualification. No framework is covered in full: only the controls that a technical reading of the configuration can verify carry a rule.
• The keys CIS-AWS and CIS-EKS are in the settings but have no display name in the interface; PQC has a display name but is not recorded in the settings of a new instance.
• The benchmark keys of host and Kubernetes rules (CIS-RHEL, CIS-Ubuntu, CIS-Windows, CIS-Azure, STIG, OWASP, PSS) show in findings but have neither a display name nor a switch in the settings.
• There is no filter by framework in the finding lists, and no compliance report export for customers.
• The compliance page counts by project and does not know folders; it is in internal validation in any case.
• The interface uses "Référentiels" in French and "Frameworks" in English for the same notion.