Ready for your audit
Security and compliance engineering
The security controls SOC 2, HIPAA, ISO 27001 and PCI DSS require, built into your systems, with audit evidence gathered as you go.
- 42 accounts pulled from OktaEach pull timestamped and signed
- Manager sign-offs in from the HR systemOne named manager per account
- 1 account unused for 90 daysIts owner confirms or removes itDue Friday
Control holds with 1 exception · Tracked until the exception closes
PassingGathered for the quarter from the systems themselves.
The access review, recorded as it runs
Rebuilt by hand before each audit
Controls we put in
Evidence is kept in Probo; Gitleaks, Trivy and Sigstore check every code change.
- 01Each control matched to the standard you are working toward
- 02Checks on every code change: leaked passwords, licenses, signatures
- 03Single sign-on, and only the access each person or system needs
- 04Evidence collected automatically, on tools you host
- 05Encryption, logging and record keeping, set up and written down
- 06Access that changes by itself when people join, move or leave
compliance/
controls/52 controls as code
collectors/Pulls from 6 sources
gates/Each code check, with its failure message
mapping/Which control meets which rule
See it work
Controls, checked every hour
Four checks before code goes live
By industry
Access records for clinics, insurers and finance teams
Who opened this patient’s chart in the last 30 days?
Nine staff, each with a scheduled visit.1 One emergency read, reviewed by the privacy officer.2
Every chart read is logged with user and reason.
Healthcare providers
Access to that file only, granted with it
Revoked and logged
Suspended; vendor manager told
The account stays suspended until then
Each item is stored as evidence, with a timestamp.
Insurance
Tested on every role changePassing
Stored with the journalSigned
Caught Tuesday; owner notifiedRolled back
Both names kept on the changePassing
Each test result is stored with the role change it checked.
Accounting and finance
How it goes live
- 01 · Optional
Gap review
What your standard requires against what runs today
- 02 · Optional
One area first
Access control fully in place and recorded, before the rest
- 03 · Security engineering
Controls and checks
Every control, code check and the evidence store
- 04 · Ongoing
Audit window
Evidence keeps collecting across the audit period