Compliance

Designed to SOC 2 and ISO 27001
controls.

Tabor is built to the controls your auditors already recognize, and it maps what it finds on your network to the frameworks that govern critical infrastructure. The inventory you get in fifteen minutes doubles as evidence. Pick a framework, pick a date range, get a report.

Framework reports
22
Mandatory covered
12
Built to
SOC 2 / ISO 27001

Compliance in OT usually means a consultant, a spreadsheet, and a six-week scramble before the audit. Tabor replaces the scramble with a button. Because the platform already sees every asset and every conversation on your network, it can produce control-mapped evidence on demand, filtered by industry and reporting period, aligned to the framework that applies to you.

Coverage

22 framework reports, in one place.

Twelve carry the force of law for critical infrastructure. Ten more are the standards auditors, insurers and boards expect you to meet. Tabor maps to both.

Frameworks with force of law

  • NERC CIP-007 MandatoryElectronic security and systems management for bulk electric system cyber assets
  • NERC CIP-004 MandatoryPersonnel risk, training, and access review for BES cyber systems
  • TSA Pipeline Security MandatoryOT monitoring, asset inventory and incident reporting under SD-02C
  • TSA Aviation Directive MandatoryOT asset inventory and monitoring for aviation, transportation and ports
  • AWIA 2018 MandatoryWater infrastructure risk assessment and monitoring coverage
  • HIPAA MandatoryConnected medical device inventory and security event monitoring
  • CMMC 2.0 MandatoryAsset inventory, access control and continuous monitoring for DoD contractors
  • NY DEC Wastewater Mandatory6 NYCRR Parts 616, 650, 750: monitoring, IT/OT separation, reporting
  • USCG Maritime Mandatory33 CFR 101.600: inventory, segmentation and monitoring for the MTS
  • Rail OT Security MandatorySCADA, signaling and communications for rail and metro
  • Rail Network Segmentation MandatorySignaling system isolation per EN 50159 and IEC 62280
  • Rail SCADA Audit MandatoryDiagnostic tools and remote access controls for railway systems

Standards and voluntary frameworks

  • IEC 62443Security level assessment across zones and conduits by Purdue Level
  • NIST CSFExecutive summary across Identify, Protect, Detect, Respond, Recover
  • NIST SP 800-82OT/ICS security assessment aligned to NIST guidance
  • ISO 27001Annex A access, logging, monitoring and asset inventory evidence
  • SOC 2 Type IISecurity and availability evidence mapped to CC6, CC7, CC9
  • MITRE ATT&CK for ICSThreat detection coverage mapped to ICS techniques
  • API 1164Pipeline SCADA security and communication protocol coverage
  • HTM 08-03Medical device cyber security aligned to NHS guidance
  • GSM-R / 5G-R SecuritySignaling security per ETSI and 3GPP railway standards
  • Rail Hardware SecuritySecure hardware review per Common Criteria and IEC 62443-4-2

How reporting works

From live network to signed report.

01

It watches, always

Passive monitoring builds a continuous record of assets, connections and events. No point-in-time snapshot that is stale the day after the audit.

02

It maps to controls

Findings are tied to specific control numbers in the framework you select, not a generic checklist. What you can prove, and where the gaps are.

03

You export a PDF

Pick a framework, pick an industry and a reporting period, generate an auditor-ready report on the sensor. No consultant, no export dance.

The regulatory tailwind

The era of voluntary OT security guidance is over. New York now mandates OT cybersecurity for water and wastewater by law. The U.S. Coast Guard issued the first mandatory federal framework for ports and vessels. TSA directives cover pipelines and aviation. Every mandate turns OT visibility from a good idea into a legal requirement, and Tabor produces the evidence.

Our own posture

We hold ourselves to the same bar we help you meet. The Tabor cloud platform runs under a documented information security management system designed to ISO 27001 controls and SOC 2 Trust Services Criteria, with per-tenant encryption, single sign-on and role-based access. Capture is one hundred percent passive and metadata-only. Designed for federal procurement, with TAA certification in process. American-built, American-deployed.

Responsible disclosure

Found something? Tell us.

If you believe you have found a security issue in Tabor, we want to hear from you. Report it to security@taborsecurity.com and we will respond. We do not pursue researchers acting in good faith.

Make the next audit boring

Turn your network into evidence.

Book a walkthrough and see a control-mapped compliance report generated from a live OT network in real time.

Book a 15-min walkthrough