Complete Compliance: Actionable Evidence Versus Simple Integrations

To comply with SOC 2, ISO 27001 or other frameworks, you need to show you are implementing the controls each framework requires. This means you must be able to collect, consolidate and deliver compliance evidence for each control. This post offers some guidance and cautions to help you get this critical task right, and explains how Trustero Compliance as a Service (CaaS) can ensure that you do.

Compliance Evidence: The Problem with Integrations

Compliance automation platform vendors often tout the number of integrations with other tools and applications their platforms support. Those integrations, the vendors say, deliver the information you and your auditor need to demonstrate compliance with your chosen framework or frameworks.

However, auditors often end up disappointed by those integrations. They deliver “evidence,” but not organized or connected to specific controls. Instead, they deliver a big pile of data that still needs to be analyzed, reviewed and tested. This creates more work and wasted time for you and your auditor, and puts your compliance timelines at risk.

Some auditors refuse to work with certain popular compliance automation tools because those tools simply grab and deliver raw data, with no context or useful guidance. In some cases, users and their auditors must manually transform that raw data into compliance evidence the auditors can actually use.

How Trustero Can Help

Trustero has a better way.

Rather than delivering large numbers of inadequate connections, Trustero Compliance as a Service (CaaS) provides Receptors. Instead of copying over as much raw data as possible, Trustero Receptors gather specific evidence and deliver it to specific controls to satisfy specific audit requirements. Trustero Receptors also deliver that evidence in actionable, context-sensitive forms and formats. This makes life easier for you and your auditor, saving time for both of you and money for you. Trustero CaaS automatically pulls just the right needles from each haystack of data, making your compliance happen faster and easier, with less cost and fewer headaches.

The Trustero platform also takes you beyond one-time compliance. Trustero CaaS scans your environment weekly and on demand, and flags out-of-compliance anomalies. A quick scan of your dashboard or weekly test results will let you know, for example, if new AWS Simple Storage Service (S3) buckets have been created and need encryption. Your dashboard will also show you exactly who has multi-factor authentication (MFA) enabled on your MFA control, not just a list of all your users and their properties. Trustero CaaS helps you avoid backsliding into non-compliance between audits.

Trustero CaaS comes with Receptors for the most popular SaaS products used by our customers, including the following.

• AWS
• GitHub
• Google Workspace
• DeepSource (code analysis)
• Jamf (Apple device management)
• Recruitee (job application tracking)
• TriNet (HR management) 
• …and many more

And all of this is just the beginning. We’re constantly working on more and better Receptors, and deriving additional benefits for you from the data our receptors collect. For example, we’re developing performance measures that will tell you how effective the information we’re pulling in is at helping to minimize risk.

Trustero Compliance as a Service. Not just data, but actionable information to enable automated, simplified and complete compliance.

To learn more about Trustero and its innovative Compliance as a Service platform, visit https://www.trustero.com. For more information about Trustero Golden Controls or to schedule a demo, visit https://go.trustero.com/demo-meeting-link or send an email to sales@trustero.com