Standards & Frameworks

TATER evaluates 5,000+ controls across 19 compliance frameworks using automated scanning and threshold-based analysis. One scan satisfies multiple standards simultaneously—so you collect evidence once and map it everywhere.

CIS M365 CISA SCuBA DISA STIGs NIST 800-53 ISO 27001 SOC 2 PCI-DSS v4.0 HIPAA NIST CSF 2.0 CIS Controls v8 CIS Windows 11 CIS Windows Server CIS Chrome CIS Edge CIS Intune CIS Google Workspace macOS Custom Frameworks
Compliance Frameworks

Every framework your auditors care about

From technical CIS Benchmarks to regulatory crosswalks like NIST and ISO, TATER evaluates each control with real configuration data—not questionnaires.

Regulatory & Industry Frameworks

NIST 800-53 Rev 5

325+ controls mapped

The gold standard for federal information security. TATER maps M365 and endpoint configurations to 20 control families—from Access Control (AC) through System and Information Integrity (SI)—giving you a continuous compliance posture instead of point-in-time snapshots.

ISO 27001:2022

93 Annex A controls

Complete Annex A coverage across all four themes: Organizational, People, Physical, and Technological. TATER links technical scan results to each ISO control and generates audit-ready narratives that describe your actual implementation posture.

SOC 2 Trust Services

5 trust service criteria

Maps technical controls to Security, Availability, Processing Integrity, Confidentiality, and Privacy criteria. Cross-references automated scan evidence so your SOC 2 Type II audit starts with machine-verified data rather than manual screenshots.

PCI-DSS v4.0

12 requirement areas

Payment Card Industry requirements mapped to your M365 tenant and endpoint configurations. TATER evaluates network segmentation controls, encryption posture, access restrictions, and logging requirements against PCI-DSS 4.0 sections.

HIPAA Security Rule

Administrative, Physical & Technical

Safeguards for electronic protected health information (ePHI) mapped to your actual tenant configuration. Covers access controls, audit controls, transmission security, and authentication requirements from 45 CFR 164.312.

Government & Defense

CISA SCuBA Baselines

Full baseline coverage

Secure Cloud Business Applications baselines as mandated by BOD 25-01 for federal agencies. TATER evaluates every SCuBA baseline for Entra ID, Exchange Online, Defender, SharePoint, and Teams with automated PowerShell scripts that match CISA's exact evaluation criteria.

DISA STIGs

Full STIG coverage

Defense Information Systems Agency Security Technical Implementation Guides for DoD-compliant configurations. TATER maps DISA STIG requirements for Microsoft 365, Windows endpoints, and Entra ID to automated checks with CAT I/II/III severity categorization.

Technical Benchmarks (CIS)

CIS Microsoft 365 Foundations

400+ controls

The most comprehensive automated benchmark for M365. TATER evaluates every CIS recommendation across Entra ID, Exchange, SharePoint, Teams, Defender, Purview, Power BI, and Power Platform using PowerShell scripts and the Microsoft Graph API.

CIS Windows 11 Enterprise

731 controls

Endpoint hardening for Windows 11 evaluated locally via the TATER Agent. Checks security policies, registry settings, audit policies, firewall rules, and service configurations against the full CIS L1 and L2 benchmark.

CIS Windows Server

580–620 controls per version

Server hardening benchmarks for Windows Server 2019, 2022, and 2025. Each version gets version-specific checks covering security options, user rights, audit subcategories, and Windows Firewall with Advanced Security profiles.

CIS Microsoft Intune

800 controls (Windows 11 + Office)

Device configuration compliance for Intune-managed endpoints. Evaluates Settings Catalog policies, device configuration profiles, and compliance policies against CIS Intune benchmarks for both Windows 11 and Microsoft 365 Apps.

CIS Google Chrome

134 controls

Browser hardening for Google Chrome evaluated via Group Policy and registry settings. Covers security, privacy, content, extensions, and network policies to ensure browsers do not become attack vectors.

CIS Microsoft Edge

285 controls

Comprehensive Edge browser benchmark including SmartScreen, InPrivate mode, password manager, telemetry, and extension controls. Evaluated locally by the TATER Agent alongside other endpoint benchmarks in a single scan pass.

CIS Google Workspace

128 controls

Covers Gmail, Google Drive, Calendar, Groups, Sites, and Marketplace security settings. Evaluates sharing policies, authentication requirements, DLP rules, and app access controls for Google Workspace tenants.

Cross-Mapping & Emerging Frameworks

NIST CSF 2.0

6 core functions

The Cybersecurity Framework 2.0 adds Govern alongside Identify, Protect, Detect, Respond, and Recover. TATER cross-maps your existing technical controls to CSF functions and categories, providing a risk-based maturity view without duplicate evaluation.

CIS Controls v8

18 control groups

Prioritized set of safeguards organized into Implementation Groups (IG1, IG2, IG3). TATER maps your technical scan results to CIS Controls and shows which Implementation Group level your organization currently achieves across all 18 control areas.

Custom Frameworks

Build your own

Create organization-specific or industry-specific frameworks with the visual framework builder. Define custom domains, map controls with threshold logic, import/export JSON for MSP distribution, and cross-reference your custom framework to any standard framework.

Evaluation Pipeline

From raw configuration to compliance score

TATER does not rely on self-assessment questionnaires. Every control is evaluated against live configuration data collected from your tenant and endpoints.

1

Collect

PowerShell scripts query the Microsoft Graph API, Exchange Online, Defender, Intune, and local endpoints. The TATER Agent runs CIS benchmarks on Windows, Linux, and macOS machines.

2

Evaluate

The V2 threshold engine analyzes each data point using typed evaluators: boolean, compare, includes, excludes, count, regex, and composite (AND/OR) rules. No ambiguity—every control has a deterministic pass/fail outcome.

3

Map

Each evaluated control is cross-mapped to every framework it satisfies. One MFA control maps to NIST AC-7, ISO A.8.5, SOC CC6.1, PCI 8.3, and HIPAA 164.312(d) simultaneously. Evidence collected once serves all frameworks.

4

Report

Gap analysis breaks each framework into sections with per-section compliance percentages. AI-generated narratives, exportable reports, and trust center dashboards present results to auditors, executives, and clients.

Overlap Detection

Eliminate duplicate evidence collection

Many compliance frameworks share overlapping requirements. Enabling MFA satisfies controls in NIST AC-7, ISO 27001 A.8.5, SOC 2 CC6.1, PCI-DSS 8.3, and HIPAA 164.312(d). TATER identifies these overlaps and maps them automatically, reducing audit preparation from weeks to hours.

Cross-Framework Mapping
MFA Policy→ NIST AC-7, ISO A.8.5, SOC CC6.1
Encryption→ NIST SC-28, ISO A.8.24, PCI 3.5
Audit Logs→ NIST AU-2, ISO A.8.15, HIPAA 312(b)
Access Ctrl→ NIST AC-3, ISO A.8.3, SOC CC6.3
DLP Policy→ NIST MP-4, ISO A.8.12, PCI 3.4
Gap Analysis

Know exactly where you stand

TATER breaks each framework into its constituent sections and shows which controls map to each one, along with the current compliance percentage. Drill down from framework to section to individual control status in seconds.

NIST 800-53 Gap Analysis
AC — Access Control
92%
AU — Audit & Accountability
85%
CM — Config Management
78%
IA — Identification & Auth
95%
SC — System & Comms
88%
SI — System & Info Integrity
81%
Coverage

Applications monitored with real control counts

Every compliance zone below has dedicated evaluation scripts. Control counts reflect the actual number of automated checks in the TATER catalog.

Windows 11 Enterprise
731 controls
Windows Server
580–620 per version
Microsoft Intune
800 controls
Entra ID
100 controls
Microsoft Edge
285 controls
Google Chrome
134 controls
Exchange Online
55 controls
Microsoft Defender
105 controls
Microsoft Teams
38 controls
SharePoint Online
24 controls
Power Platform
22 controls
Microsoft Fabric / Power BI
22 controls
Microsoft Purview
6 controls
Google Workspace
128 controls
Linux (RHEL / Ubuntu)
20 controls
macOS (Apple Silicon / Intel)
Agent-based checks
Azure Cloud Resources
Multi-cloud posture

Control counts reflect the current TATER catalog. New controls are added with each CIS Benchmark and SCuBA baseline release. Custom controls can be defined with the V2 threshold engine for any data source.

AI-Powered

Compliance narratives that write themselves

For each standard section, TATER analyzes your linked controls, their current pass/fail status, overrides, and exceptions—then generates a narrative tailored to your actual posture. Not generic boilerplate. Your specific implementation, described accurately.

AI Narrative — NIST 800-53 AC: Access Control
Generated Narrative
The organization enforces multi-factor authentication for all privileged and standard user accounts through Microsoft Entra ID Conditional Access policies. Access reviews are conducted automatically through TATER's control testing schedule, with quarterly recertification of privileged role assignments. Legacy authentication protocols are blocked at the tenant level, and session timeout policies enforce re-authentication after 60 minutes of inactivity.
Linked Controls (6 of 14 passing)
ENT_001 Block Legacy Auth ENT_003 MFA Enforced ENT_005 Session Timeout ENT_010 Privileged Roles ENT_024 MFA Capable ENT_032 Conditional Access
Frameworks Satisfied
NIST AC-7 · ISO A.8.5 · SOC CC6.1 · PCI-DSS 8.3 · HIPAA 164.312(d) · CIS Controls 6.3
300+
Standard sections covered
19+
Frameworks supported
1-Click
Generation per section
Editable
Review, revise, and save

Ready to map your compliance posture?

Get audit-ready across all frameworks in days, not months.

Launch TATER → Contact Sales