The TATER Control Framework

The gold standard for federal information security. TATER maps M365 and endpoint configurations to all 20 Rev 5 control families-from Access Control (AC) through Supply Chain Risk Management (SR)-giving you a continuous compliance posture instead of point-in-time snapshots.

Complete Annex A coverage across all four themes: Organizational, People, Physical, and Technological. TATER links technical scan results to each ISO control and generates audit-ready narratives that describe your actual implementation posture.

Maps technical controls to Security, Availability, Processing Integrity, Confidentiality, and Privacy criteria. Cross-references automated scan evidence so your SOC 2 Type II audit starts with machine-verified data rather than manual screenshots.

Payment Card Industry requirements mapped to your M365 tenant and endpoint configurations. TATER evaluates network segmentation controls, encryption posture, access restrictions, and logging requirements against PCI-DSS 4.0 sections.

Safeguards for electronic protected health information (ePHI) mapped to your actual tenant configuration. Covers access controls, audit controls, transmission security, and authentication requirements from 45 CFR 164.312.

Secure Cloud Business Applications baselines as mandated by BOD 25-01 for federal agencies. TATER evaluates the SCuBA baselines for Entra ID, Exchange Online, Defender, SharePoint, Teams, and Power BI — 73 of the 130 controls run as automated checks that match CISA's exact evaluation criteria, and the remaining 57 as Manual Review. Google Workspace is covered by its own baseline set, below.

CISA's Secure Cloud Business Applications baselines for Google Workspace, the non-Microsoft half of BOD 25-01. Covers Gmail, Drive & Docs, Calendar, Chat, Meet, Groups, Sites, Classroom, Gemini, and Workspace-wide common controls — sharing policies, authentication requirements, DLP rules, and app access controls. Automated evaluation is in progress: 6 of these controls are checked automatically today (SPF, DKIM, DMARC and 2-Step Verification enrolment); the remaining 129 are catalogued with full guidance for manual review while automated checks are built out.

Defense Information Systems Agency Security Technical Implementation Guides for DoD-compliant configurations. TATER ships STIG requirements for Entra ID and Intune in the cloud scan and for Windows Server and Linux on the agent — each as a Manual Review control carrying its own guidance, remediation text and evidence capture — plus the full DISA STIG Windows Server 2022 (V1R5) definition to crosswalk against.

Protection of Controlled Unclassified Information (CUI) for the Defense Industrial Base. TATER crosswalks the 110 NIST SP 800-171 security requirements — aligned to CMMC Level 2 — across all 14 control families, tying each to the M365 and endpoint checks it already evaluates so contractors can track assessment readiness continuously.

The UK NCSC baseline for essential cyber hygiene, across all five technical themes — firewalls, secure configuration, user access control, malware protection, and security update management. TATER maps each to the M365 and endpoint checks it already evaluates, so UK organisations can track Cyber Essentials readiness from live configuration.

The Australian Cyber Security Centre (ACSC) Essential Eight mitigation strategies — application control, patch applications, configure Office macros, user application hardening, restrict admin privileges, patch operating systems, multi-factor authentication, and regular backups. TATER crosswalks each strategy to its M365 and endpoint checks for continuous maturity tracking.

The most comprehensive automated benchmark for M365. TATER's own controls are evaluated automatically, on every scan, then crosswalked by identifier to all nine CIS benchmark sections — Entra ID, Exchange, SharePoint, Teams, Defender, Purview, and Microsoft Fabric.

Endpoint hardening for Windows 11 evaluated locally via the TATER Agent. TATER's own controls check security policies, registry settings, audit policies, firewall rules, and service configurations, crosswalked to the full CIS L1 and L2 benchmark.

Server hardening benchmarks for Windows Server 2019, 2022, and 2025. Each version gets version-specific checks covering security options, user rights, audit subcategories, and Windows Firewall with Advanced Security profiles.

Device configuration compliance for Intune-managed endpoints. Evaluates Settings Catalog policies, device configuration profiles, and compliance policies, crosswalked to CIS Intune benchmarks for both Windows 11 and Microsoft 365 Apps.

Browser hardening for Google Chrome evaluated via Group Policy and registry settings. Covers security, privacy, content, extensions, and network policies to ensure browsers do not become attack vectors.

Comprehensive Edge browser benchmark including SmartScreen, InPrivate mode, password manager, telemetry, and extension controls. Evaluated locally by the TATER Agent alongside other endpoint benchmarks in a single scan pass.

Antimalware hardening evaluated on-device by the TATER Agent: all 17 Attack Surface Reduction rules plus cloud-delivered protection and MAPS reporting, real-time and behavior monitoring, archive and removable-drive scanning, scheduled scan and signature-update policy, quarantine handling, and blocking of potentially unwanted applications.

Foundational AWS account-security controls — IAM, logging (CloudTrail / Config), monitoring, networking, and storage exposure. TATER assesses these two ways: 14 rules run automatically against an AWS CLI JSON export you upload (IAM / S3 / CloudTrail), and the multi-cloud posture API ingests findings pushed from an external CSPM scanner. TATER does not hold AWS credentials or scan a live account itself, so the 30 benchmark items ship as a tracked checklist that those two inputs fill in.

Server and workstation hardening for Ubuntu and Red Hat Enterprise Linux, evaluated locally by the cross-platform TATER Agent — filesystem, service, network, logging, and access-control checks mapped to the CIS Linux benchmarks.

Mac hardening evaluated locally by the same cross-platform TATER Agent — FileVault, firewall, Gatekeeper and SIP, screen lock and login window, sharing and remote management, software update policy, and audit configuration. Runs on Apple Silicon and Intel in the same scan pass as the Windows and Linux fleet.

Microsoft SQL Server configuration hardening — surface-area, authentication, authorization, auditing, and encryption settings, crosswalked to the CIS SQL Server benchmark's control areas. There is no SQL Server scanner: these 20 controls ship as a review checklist your DBA works through, with TATER handling assignment, evidence, exceptions and framework roll-up. The pass / fail call is theirs, not a scan's.

Container host and daemon hardening — daemon configuration, image and build files, container runtime, and Docker security operations, crosswalked to the CIS Docker benchmark's control areas. The TATER Agent does not run inside container hosts, so these 25 controls ship as a review checklist your platform team works through, tracked and evidenced in TATER like any other control.

Kubernetes control-plane and worker-node security — API server, etcd, kubelet, RBAC policies, and pod security, crosswalked to the CIS Kubernetes benchmark's control areas. TATER has no cluster connector: these 25 controls ship as a review checklist, so you can evidence cluster hardening in the same register as everything else without TATER pretending to have scanned it.

Cisco router and switch hardening — management-plane, control-plane, and data-plane configuration for IOS and NX-OS. Paste or upload a running-config and TATER evaluates 22 built-in rules against it automatically (AAA, SSH, SNMP, logging, VTY and service hardening) and records the results as findings. TATER does not log into your network devices; the remaining benchmark items in the 25-control checklist are reviewed by hand.

Palo Alto Networks firewall hardening — device management, security zones and policies, logging, and threat-prevention configuration, crosswalked to the CIS Palo Alto Firewall benchmark's control areas. TATER has no PAN-OS connector, so these 22 controls ship as a review checklist. (The Cisco card above is the one network benchmark with automated rules, and those run against an uploaded config.)

The Cybersecurity Framework 2.0 adds Govern alongside Identify, Protect, Detect, Respond, and Recover. TATER cross-maps your existing technical controls to CSF functions and categories, providing a risk-based maturity view without duplicate evaluation.

Prioritized set of safeguards organized into Implementation Groups (IG1, IG2, IG3). TATER maps your technical scan results to CIS Controls and shows which Implementation Group level your organization currently achieves across all 18 control areas.

Create organization-specific or industry-specific frameworks with the visual framework builder. Define custom domains, map controls with threshold logic, import/export JSON for MSP distribution, and cross-reference your custom framework to any standard framework.

TATER Ops ships three ITIL 4-aligned process profiles out of the box: Incident Management (8-state lifecycle, impact/urgency/severity, business service, configuration items, per-priority SLAs), Service Request (Approval Pending + Fulfilled states, customer-visible by default), and Problem Management (root-cause analysis + Known Error states). Field-visibility templating means your team only sees the columns the chosen process requires.

The Computer Security Incident Handling Guide lifecycle (Detected → Triage → Contained → Eradicating → Recovering → Resolved → Post-Incident Review → Closed) ships as a pre-seeded process profile with a False Positive branch and aggressive Critical SLAs (15-minute response). Use it standalone for security incident response or alongside the ITIL Incident profile for split ITSM/SecOps workflows.

Govern the AI tools, models, and agents your organization uses. The AI Governance pack ships an AI System Inventory (classified by EU AI Act risk tier — prohibited / high-risk / GPAI / limited / minimal) and a 22-control checklist crosswalked across ISO/IEC 42001 (clauses 4–10 + Annex A), the NIST AI RMF (Govern / Map / Measure / Manage), and the EU AI Act (risk management, data governance, transparency, human oversight, logging). AI systems link to your vendor register for third-party AI supply-chain risk, and posture rolls up into TATER Insights — answering "what AI do we use, how is each classified, and are our AI controls in place?" as the EU AI Act comes into force.

SOC 2 readiness without re-scanning. TATER crosswalks the Trust Services Criteria — the mandatory Common Criteria (CC1–CC9) plus the optional Availability, Confidentiality, Processing Integrity, and Privacy categories — to the M365 control checks it already evaluates (MFA, conditional access, privileged-access management, logging, DLP, device compliance, and more). A computed readiness view shows coverage per category and per criterion, citing the exact controls that evidence each one and flagging the criteria that remain auditor-attested. Surfaced in TATER Insights and queryable from the MCP server for live SOC 2 gap analysis.