Name: Lunch & Learn: Value Beyond the Audit
Uploaded: 2026-04-22T17:16:10.707Z
Duration: 55 min 24 s
Description: Lunch & Learn: Value Beyond the Audit

Transcript for "Lunch & Learn: Value Beyond the Audit": Welcome, everyone, and thanks for joining us for today's launch and learn. Today, we're gonna be talking about the value beyond the audits. I'm Jordan Penn. I'm the customer success manager here at Humana, and I'm pleased to have you all on board with us today. Today, we're gonna walk through a real life, story with Southeastern Printing and our trusted MSSP partners, Bright Defense. We'll cover what it looked like before Drata, the frameworks that they had to work with, what it looked like prior to implementing Drata, what Drata has changed for them, and what the post audit life looks like. And, since the implementation, what is the next steps for them? As a quick disclaimer, I did mention we have an MSSP, involved in today. Not every Drata customer does have an MSSP, but that's totally fine. Everything we'll talk about today is really about the principles and operating models, and this should resonate with all GRC teams across. How to use Drata year round, how to avoid alert fatigue, and how to turn your compliance into an asset for your business. Whether that work is done by an MTS team, like by defense, an internal security team, or just one very motivated person with a lot of hats. That pattern stills apply. Today, I wanna introduce our speakers who will be joining us. I have forehead Alvaro, who's the director of IT at Southeastern Printing. And along with him, I also have Tim McArthur. Tim, you might have to help me with this one. I should have checked here. MetroCard. Yeah. No no problem, Jordan. Also, from Bright Defense, their MSSP partner who guided them through their SOC two, journey on the broader GRC program. Welcome to you both, and thank you both for lending your time and voice, here today. Appreciate that. I'll be moderating as a fire style, conversation. And at the end, we'll be open for call for any questions and answers that you have. So please, feel free to share them in the chat, and we can bring them all along the way as well. Today, we're focused on the customer story and beyond the audits, and the beyond the audit operating model. We'll touch on the MSSP relationship, but we'll save a deeper dive into that conversation related to webinar, how to get the most out of your MSSP in Drata for a follow-up session, in the series. Let's start by setting the scene. What did life look like for sawdust imprinting for Drata? Ori, I'll turn, it over to you. hi, guys. It's a pleasure to be here. For us, it was, basically, you know, having all the information policies, controls, and whatnot in SharePoint, which is very time consuming, very hard to keep control on on versioning as well, and having just information scattered all over the place, evidence as well. Again, for lack of better terms, it was very, very, very hard to maintain. What would you say were the hardest thing? So you mentioned the version history of all this evidence, making sure that the evidence was gathered in the proper way, keeping a hold of all these strength you know, strangling all the cats together. What would you say was the hardest bit for you? I would say the hardest part was to, again, you know, aside of keeping the version in control was, you know, also relating those controls to specific evidence and, like, naming properly the the evidence such that it was matchable to the actual policy or control and keeping all that information on the different domains that were being evaluated in, you know, multiple folders and different locations that needed to be shared among different, you know, players that were helping us to gather this information and assisting them with being able to, provide that information to us in a timely fashion. And prior to Jada, how many frameworks were you maintaining at Southeastern Printing? HIPAA and HITRUST mainly. We actually wanted to talk to later, but the the main two were HITRUST and, and HIPAA. Alright. And, also, prior to that, how are you handling anything related to security questionnaires, RFPs, managing vendor? That's a that's a that's a good question and and, you know, very complicated process to to say the least because, you know, questionnaires are not always the same. They come they come in different, forms and flavors from different vendors. And, given that information, I know you had to go fetch, you know, different wording or or maybe even explain certain things differently on the questionnaire. And filling out those questionnaires was really time consuming and very exhaustive for the team or myself, to be able to gather the information properly and disseminate it into the document and send it back to, to the vendor, which would sometimes come back for for the most part, come back and ask for additional questions. So, you know, the back and forth was also overwhelming. Yeah. So you mentioned the number of tasks you had to do. You mentioned how heavy those tasks were on the team. I think the next question is, how big was that team that had to execute all of this? Probably talking about total of three people, including myself, and then also working with an MSP, which also provided us with some information, but, you know, mainly the, the internal team, about three people. About three people. And I imagine that was also heavy on bandwidth, taking away from other activities that you could be doing to ensure that your your organization was actually secure, I would say. 100%. And that's and that's that's a key thing that you mentioned that, actually, because, you know, all this back and forth of actually having to document, you know, information and giving back this information back to, to vendors, you know, took away time from us to actually ensuring that the, secure processes are in place and actually, being enforced. So what point did you then decide all this needs to change, right, where this is we can't handle this anymore. We we need to do better. What was the catalyst of change for you? Basically, I was, asked to also have, SOC two in place. Right? So, you know, SOC two type one, which we are currently SOC two type one, and we're working towards SOC two type two, and, understanding the fact that, you know, there was a lot of controls that actually overlapped. So, you know, the the idea was to, like, figure out a way to have a central location, a one source of truth where we can actually have all the information, easy to to audit, easy to, make changes and, you know, keep versioning and keeping the different pieces of evidences that we needed in a single location. So I started looking at a GRC tool that would actually give us that, and that's where, you know, I found RADA. So not only were you managing HITRUST in HIPAA, you also had all those security questions you had to deal with. And then on top of that, software came piling on. And I imagine the timelines as well didn't fit with the the the needs and the requests here. So this also then prompted you to look for a solution for that. So you mentioned Drata came into into the picture for you. What were some deciding factors as to why Drata would be the right tool for you? What were some key elements that you you wanted to see out of the platform you're gonna work with? First and foremost, ease of use. I'm like, it's very, user user friendly. It's very intuitive to actually be able to, get to the different dashboards and different, controls and whatnot that needs to be configured in the system. I'm like, there's a lot of integrations that Drata also has in place that allows us to connect our, our antivirus solutions and, you know, being able to just overall see the, the status of each user. I'm like, are they being compliant with training sessions that they need to do? Are their machines under compliance and whatnot? So I'm like, all of all of that information is there, you know, in front of your eyes and makes it easier for anyone who's managing the, the controls and managing to make sure that, you know, you can comply with everything that needs to be done to get the final certification of the framework. You know, it's it's there. So that itself, meant meant meant a goal to me. And so, I mean, like, I really, went towards that, that initiative and also the fact that, you know, I felt a lot of collaboration from the team from Dara as well and, made everything just, a lot easier for me. Yeah. So not only did the complexity of your program grow, the timelines also became, you know, smaller, so time to action was very important for you. Did the head count grow with that as well? You know, with all the demanding work growing, did you have more head count available to you to be able to do all of this, or what did that look like? Same team of. three? The head the the the headcount did not increase. So I'm like, again, this this actually made us, made us more, productive. And, like, we were be able to be more effective and, you know, gather information because even though we still still have the same headcount, I'm like, we had a tool. We have a tool that now, you know, gives us a lot of the information that we had to go fetch before, and now it's there for us to, to just be able to utilize it and present it to any, auditor. So now that we're able to become more efficient, I think this is the point where we also realized, hey. The complexity has grown, so we need expertise. And this is where the introduction of, BrightDefense came into into place. Right? So I'll invite Tim into the conversation here because this was the pivotal moment. We had sub two deadlines looming. Everything was, against us, but we were working towards a a a plan. What did you see when you you first joined, the relationship? What's the first. authorization? Yeah. Thanks, Jordan. Like any organization, when we first walk into a new environment, there's kind of what we were told during the initial process of what to expect, but then when you actually see it in reality, it's a lot different. Sometimes we're undersold and then we're oversold. But, usually, we we meet the customer where they're at in their journey. Right? And so in Jorge's instance, you know, they have policies, procedures already, you know, through their HITRUST program. Our job is to bring that program that was offline now into Drata. And so we went through a gap assessment, walk through all their existing policies and procedures, and try to understand, okay. Now for SOC two, what do we have to layer into each of the policies as we're bringing them into Drata, publishing them out to the users, and then start going through our, control, reviews? And so that process took some time to to build up all the new policies, procedures, get that out, get the gap assessment, fully remediated to the point where we were able to get through SOC two type one compliance. Yeah. And if I remember correctly with this, we also had a deadline that wasn't movable. Right? We had to meet that deadline. Was was any of this realistic in your opinion with the gap assessment you did and all the remediation that come that had to come into place? Was this a feasible timeline to work on there? Yeah. You know, everyone has, different timelines, and so we try to make sure that, we're meeting the customer where they want where they need to be in terms of that. We have to scope it properly. Right? And so, you know, with our vast expertise inside the platform but also with all the frameworks, we understand, okay, if we're driving to a certain deadline, what is feasible to bring into the program now versus later on once we're in the observation period? Can we do kind of more during that time that we act that we have? So for both of you then, what the collaboration look like in Drata? Yeah. Go ahead. Go ahead. Go ahead, Tim. Yeah. So, typically, we're meeting on a biweekly cadence cycle with Jorge and team, to basically, walk through, each of the whether the policies or controls, and then we each kind of have our homework assignments. And then, hopefully, you know, the team is doing their part to remediate the, whatever the homework assignment was for that week. And then the following week week, we're checking back and then updating, the controls in Drata, collecting evidence, even manually, setting up all the monitors, remeeting all remeeting all the monitors. Right? Making sure along the way that Jorge and team, they understand what is the purpose of these monitors. Right? Do why do we have these things just firing off all the time? How can you help us remediate them? And so this, you know, collaboration allows us to manage the program, cohesively between the two teams. Absolutely. I totally second, what Tim just said. I'm I'm basically you know, that that, collaboration back and forth where we actually have, you know, meetings, on a on a good cadence and also, having the ability to actually, you know, send out emails and and communicate via via emails and via, actually, a project management tool. We actually do, you know, real project management, and we actually assign tasks to each other and make sure that tasks are being completed on a timely fashion. And if something is falling behind, then, you know, make sure that we address those as quickly as possible so we can continue to to, get to the goal, which is, you know, getting the certification, you know, in that some sometimes in a very tight deadline. In the case of the SOC two type one, you know, that was definitely the, the case for us. Yeah. I know in this scenario, we're talking about smaller teams and smaller organization. But one of the things that keeps getting repeated was getting everybody aligned, essentially, making sure everybody knew their part, making sure everybody was doing their part. This is something that we come across, especially with large organizations where it's harder to get teams wrangled and making sure that they can do what they're supposed to do. Tim, you made mention of the the why behind it. Right? One of the driving factors is understand getting people to understand what they needed to do and why they needed to do it. Aside from that, how are you then able to build a sense of urgency to ensure that things were actually done in a timely manner? Yeah. You know, we try to make sure our customers understand, kind of what is the essence of what the framework is asking for. Right? And so we try to guide them to the outcome that is, you know, balancing, you know, either financial things that they have to purchase in order to match the control versus the actual security, component of does this actually make us more secure? Right? Versus, you know, maybe for now the maturity level of this control might just be, something where we just have a policy for. Right? And so as we go through each of the controls, we're kind of evaluating these criterias to make sure that we're advising them properly on, okay, with limited budget, short time frame, what can we get accomplished with what level to be able to kind of pass through this this the essence of this control requirement? And, Jorge, on your side then, what what did that look like? Just ensuring that everybody that you're working with was following the path as well and, doing their part. What what did that look like for you? Well, basically, you know, again, following following the project management, like I said, I'm, like, an understanding the responsibilities and assignments for each person and, you know, making sure, for example, on the on the MSP side, since we don't have a very large IT team, making sure that the remediations are being completed in time. You know, making sure that whatever we are identifying and and passing on to them is actually taken care of. And running the controls again and running whatever vulnerabilities, scams, or any other tools that we have in place to actually verify that everything has been remediated properly. Internally as well from us, you know, making sure that we're actually, you know, keeping keeping an eye of what's going on in Drata or, you know, looking at the notifications, looking at the dashboards, and ensuring that we're following, the, the path that that controls is actually telling us, hey. You know, something is out of compliance. You know, take a look at it, figure out what it is, create a task for, someone that we have assigned to take care of it and get it done. Tim, I'll drop this back on you because you made mention of something very interesting, the control maturity at this point. Right? So, a lot of customers come in, especially first time SOC two, you know, first time SOC two doers, we need to get it done. Always confuses to how do I scope my controls? How do I know if I'm implementing the right things? How do I know if this is enough? Right? How do you help teams understand, you know, what the gap is, how they can remediate that gap, or what is going to be a future, sort of implementation for them? How they can assess what the majority of current state is and what the future majority of that could look like? Yeah. Definitely. You know, Drata provides a great blueprint through the control, mappings that that they have. Right? And that cross mapping capability between all the frameworks. But that is a prescriptive approach to to if if you're a SaaS company like Drata, if you do these things, then you can become compliant. Right? And so a lot of our customers may meet that, you know, ideal profile, but a lot don't. Right? And so we help scope their their program to match their what they actually do. Right? And then looking at, each of the the requirements themselves from the framework side to make sure that, okay. You know, the framework is asking for us to provide x y z, things to to do to match that requirement. What can we, comfortably achieve in the short time frame? Right? Maybe it's only one out of the three things, you know, and so we're gonna track these things in our project management tools. Jorge mentioned, that there's future development that can be, enhanced in the future, you know, for that particular control or that particular particular requirement. So in in your opinion, what were the biggest gaps between where Southeastern Printing was, at the initial time that you got involved with them and where they needed to be for SALT two? Yeah. So typically, you know, policy is already in place. It's just, getting the additional SOC two things covered. Right? So those aren't very major items. Sometimes it's more on the, IT control side, right, where, they just don't have, certain things in place. And that's where working with the team, you know, enabling all the automation features inside of Drata, making sure that they understand what all these monitors now that once we enable all these integration points, what are they doing? Right? Making sure that as a team, we're able to remediate those in a timely manner. Yeah. This is all rivets and stuff. I mean, for anyone listening who doesn't have an MSSP, like, Bright Defense, it might sound like, hey. Okay. This is. great. I don't have an SP, like, by defense. What do I do? The patterns here still apply. Even if the partner is just your internal security need or it's just a spreadsheet, you know, you have to have some of the old gap assessments. You have to turn that into a prioritized plan inside of Drata. So understanding what what can be done today, what versus what needs to be done tomorrow. And you can create a simple cadence of check ins, right, you failures, review risks, and just make progress, right, towards your your your goal. The names and job types you can change. The operating model doesn't have to. Everything here still applies to you. So we've gotten, into the stage of, hey. We're getting ready for an audit, and now we're about to enter that first audit. What does that engagement now look like as you, enter that first SOC two type one with the auditor? Jorge, I think this is more support you since you had to engage with the auditor on your side. How did you feel going into that first audit knowing you had the support from Drata, knowing you had the support from an MSSP? Did that give you any confidence in in your ability to achieve what you needed to achieve, or did you still go in with jitters? No. No. No. No. Absolutely. I'm like, and like like you mentioned, I'm like, not not everybody might need or require an MSSP, but I'm like, I highly, recommend it. I'm like, it's, definitely helpful to have somebody who has walked this path, you know, multiple times in the past, you know, hundreds of times, you know, being, working on on HITRUST, SOC two, and different frameworks that they have expertise on. So I'm like, having having them by your side, you know, being able to identify those gaps, being able to get the assessment, being able to get the knowledge that they can bring to the table. I'm like, it's it's invaluable. I'm like, it's something that I really appreciate having, close to me and being able to, you know, bounce ideas back and forth of what we're trying to achieve, and they're telling us what the best path or the best practices are to be able to achieve what we're trying to do. Yeah. And, with that then in place, you've established your program. You sort of build that out. You're getting ready for an audit. What sort of confidence level did it give you in knowing that you had continuous monitoring built in? Did that sort of make you wary about things before you put into the audit? Did it give you more confidence about the ability for you to achieve this audit? How did that leave you? Absolutely more confidence. I'm like, in the past, it was really hard to be be able to figure out when actually something went out of compliance, because unless you were actually actively doing, you know, different tests or running vulnerability scans or, you know, checking if everybody's getting their patches in their computers and things of that effect, That was, you know, something that was very tedious and something that was not done on a on a regular cadence. Now that we actually have Drata monitoring all these different statuses, I'm like, we don't have to worry about it. I'm like, the the platform, you know, warns us of what is going out of, compliance, and we can take care of it right away. And, Tim, on the MSSP side, how do you give customers the confidence in what they're doing with continuous monitoring? How do you help help them understand the importance of that continuous monitoring in their program? Yeah. So, we assign a dedicated, ISM, information security manager to the programs. Right? That it's their job is to also watch for these monitors. But, hopefully, along the way, as we've been building out the program with Jorge and team, we've given them, the knowledge of how the platform works, and we've enabled all the automations, the workflows to get, you know, the the things that they should be handling on a day to day basis, like employee onboarding, offboarding tasks as they're creating new infrastructure, how to remediate all those infrastructure alerts. Right? And so our job is to maintain the program's, evidence cadence cycle, the policies, procedures. Right? So as things fall out of compliance from, other things not related to onboarding, offboarding, and infrastructure, that's where our ISM would be working with, Jorge's team to remediate all those additional controls. Right? And so as we're continuing to meet, we're collecting evidence. We're building towards, you know, our SOC two type two compliance. And then usually from there, annually, there's other things we have to do to get ready, right, and to ensure that, the program is monitored so that whenever an auditor wants to come in any day, the program's ready to go instead of just waiting the last couple months before an audit actually happens to to prepare everything. So, Hari, it's a first assessment to say on your side your team went from being reactive to more proactive, and it's a sports with GRC program. But for Tim then, the question would be, how do you balance continuous monitoring with avoiding alert fatigue? Yeah. It's it's the tough part. Right? Because, you know, there's things that are not in our control, and sometimes, you know, there are communication gaps, you know, as as he prints hiring a bunch of people all the time or if there's people, you know, off boarding, we don't get ahead of those. But, you know, these alerts will fire off and, you know, we have a conversation from there, right, on the the remediation path. And so, you know, having kind of asynchronous communication through our Asana project, management platform, but also in our real time conversations as we're meeting them, weekly, we're able to kinda get over these, these these these alerts that kinda pop up all the time. We also look for ahead of time which evidences that we need to start collecting and and refreshing because we already see that they're expiring from the evidence library. We have dashboards that are giving us this information so we can get ahead of the curve and, like you said, be more proactive in the management of the program. That's good to hear. And, Absolutely. Corey, on your side, would you say continuous marching has helped you catch any issues that could have been more expensive to fix later? Not a 100%. I'm like, like, team was mentioning. I'm like onboarding new people. I'm like, being able to make sure that the agent is actually deployed, and we have all the information gathered from from the, laptop or, you know, desktop that was assigned to that specific new person that was onboarded, looking at their background checks, looking at all the, different things that are happening in real time, basically. You know, if somebody's also off boarded, you know, it it also asks you for, hey. You know, can you provide me with off offboarding information or offboarding evidence? And and everything is, just there, available to you, you know, to use it. And it advises us. It advises, you know, our I ISM and and and and Bright Defense, and we're both, you know, keeping an eye on it. And if, you know, one of us, for whatever reason, missus said the other one will catch it, and, you know, that's how we make sure that, you know, we keep up to date. So one of the benefits of Drata is the ability to bring all your GACO program into one single glass pane of view. Right? So I imagine for you the first time turning on Drata, turning on the monitoring and plugging in all these different systems, you get all these different alerts, popping out at you. I imagine that could be overwhelmed for some. But for everybody in the audience then, just give us a a sense of what's your advice on the first dashboard or the first kind of, tracking habits that they should build in terms of, you know, addressing these these different failures or these different remediation that they're able to catch. I think, for the for the most part, you know, like, Timo say, I'm afraid. In our case, we already had a lot of our policies already written, and we had already achieved HITRUST r two certification. So with that in mind, there was a a few tweaks that needed to be done, you know, even for for HITRUST because some of the change some of the some of the, requirements of have changed even through through time be between, you know, the first time when we got certified in 2024 and then then we had a they interim in 2025 and now going through the recertification for 2026. So making sure that we're keeping up up to date with all the different policies and requirements of myCSF and making sure that those, policies also match, you know, what we're trying to achieve for SOC two type two. So, again, you know, it's it's night and day having all this information from spreadsheets to now have it in a in a in a system that's, again, the single source source of truth, and we don't have to worry about where things are at because we know where they are. And on your side, Tim, what would you always recommend to customers as the first point of focus? Right? Like, you turn all these on. You see these alarms. Where where do you start? Essentially, how do you know you're you're taking the right first step If there isn't such a thing as the right first step. Yeah. I'm not sure if it's the right first step, but we typically start, guiding customers towards policies first. Once we're once we're able to get through the policy side and the personnel acknowledge all the policies, a lot of the controls start glowing green. You start feeling you made significant progress in the platform. And so we help the customers understand, like, what are the drivers of these metrics that and these these toggles that that, they're seeing in the dashboards. And then we start going through all the monitors because though that can be overwhelming. We've seen some customers start there too. Right? And that that's fine. It kinda depends on the situation. You know, if they have, a heavy footprint, built out in the cloud and they have all these, tools enabled, sometimes we start there, right, because it's just so noisy. But there's also an art to kind of scoping, these connections, right, and and allowing kind of just, you know, what's necessary because sometimes if you just plug it in directly, you're enabling everything and it's gonna fire off nonstop. No. That definitely that's a good point you bring there. Scoping of controls, scoping of, you know, connections, all that is very important to make sure you can reduce the noise, so you can focus on what is important and especially important for your program, as you go along. Very riveting stuff. So we mentioned about, you know, pre Drata, building the Drata program, building a GRC program. One item that we haven't touched back and related back to is the security questionnaires, part of this. As a part of your Drata platform, one of the essential things that you also get along is a trust center. Have you been able to leverage that trust center in any way to support, with these security questionnaires? What does that look like implementing that trust center for your team? Oh, it's it's it's it's actually a game changer. I'm like, one of the things that, you know, we used to get a lot before is, can you, can you answer this security questionnaire? I'm like, and, you know, we had to go and scramble and try to get that information in there. Right? And the other thing was, like, can, you know, can you show me proof that, you know, you're actually certified and whatnot? So I'm like, now we can actually, you know, send them to the, trust center, and they can actually see which certifications we have in place. They can review our policies, and they can actually go ahead and submit their questionnaires. And based on all the information that we have provided there, like, the, trust center is able to fill out, if not everything, most of the information that needs to be filled out automatically without us having to invest that time. I think you mentioned something that's very important. The the trust center, more helpful in getting, you know, teams to self serve, hasn't necessarily elevated the fact that questionnaires will still come your way then. But with having those questionnaires still come, has that been as intensive to manage? So I I see here that it reduced your turnaround from days to to just hours. Is it the volume of questionnaires that went down that that diminished? Is it the capabilities that you've been able to put in place that has made your turnaround time a lot better? What can you share would? say I would I would say both. I'm like it's a combination of both. I mean, like, there's there's still some, entities that require some vendors that require some, additional questionnaires. But, overall, just having the trust center itself and being able to see that or all our policies are actually listed in there and that they can, you know, self serve themselves with, you know, looking at our at our, you know, SOC two report or I or our HITRUST, certification. I'm like, it's it's it's a win win situation. I'm like, it's easier for them. It's easier for us. And they if they have any additional questions, they will come back. But most most of the time, they don't. So it's it's it's been it's been a game changer for sure. Alright. So we've gone through this whole story. We've entered our first major milestone, as you mentioned, sub to type one. Kindly working towards the type two part. After your type one, what was the feeling you you got in terms of what work is left to be done here? The work left to be done is actually, you know, staying compliant. Right? I'm like, we need to make sure that, everything that was actually put together for, the type one, it's actually, be able to be assessed. Right? So I'm like, we can we can actually prove that every every control and every, piece of policy that we have we have in place is actually being completed and actually being it's it's it's actionable items that we have in place, and we can easily prove that we've been following through and everything is still, you know, the way that we, presented it once we had it in type type one. So by the time that we get to actually get the assessment, we should have no problems whatsoever, you know, just passing the type two. With having continuous monitoring in place, with having support from an MSS MSSP partner like Pyke Defense, where do you think your team spends the most time, currently as it relates to your security program? I would say probably in doing, some of the remediation. So, I mean, like, even though we've been getting a lot better about it, I'm like, now we're doing, vulnerability scans and and penetration testings more more more often and whatnot. So I'm like, it's not a a, a yearly process. It's more like a quarterly process now that we're looking at, you know, vulnerabilities and, making sure that everything is in sync. And, also, of course, you know, taking into account what, you know, Drata is is, providing us Oh, as information that it's really useful for us to be able to maintain our system compliant. so the point you make actually ties back to something Tim had mentioned in the beginning. We'll carry it back to control maturity. Right? So taking your vulnerability scattings or your we're pretty just testing from once a year to quarterly, that all plays a part in control maturity. So, Tim, how do you help support customers, that don't necessarily understand what control maturity looks like. And that feel like because I've done the audit this year, I should be good for next year. How do you, get them to understand that, you know, the point in time of what you did today does not necessarily reflect where your security program should be tomorrow? Yeah. That's that's, a huge misconception that we try to to kind of flush out with our customers because, yes, achieving the first compliance report is a is a great achievement for everyone that, you know, everyone will take some time to celebrate. We have a decompression time period, but then after that, we're going back to work. Right? Because that's just the first step of building the security program. Now the hardest part is to manage and maintain that through continuous monitoring and what we call continuous compliance. Right? Like, the notion of that any day the auditor wants to come in, we're ready to go. Right? And so maintaining all the controls, you know, above, like, a 90%, threshold from the data dashboard is important for us to achieve. You know, we also look at the the level of the maturity using the CMMI control, maturity matrix, maturity monitoring, indicators. Basically, you know, most people that have gone through SOC two type one, we may only be at level one or level two, meaning that, you know, this control exists on on paper. It's written down in a in a policy, but we're still not doing everything we say we're doing. Right? Maybe it's change management. The changes are tracked maybe for criticals, but are we tracking every single change consistently and performing? You know, that would get you to, like, level two. Right? Level three would be, are we managing this towards an SLA? And then level four is, like, are we optimizing this entire process? Is it fully ingrained in in what we do? Right? And so most customers, you know, even though we got the piece of paper, we're still maybe at a level one maturity. Can we get them to level two this next coming year? Do we bring on more controls into, the scope of the actual audit itself? You know, sometimes for SOC two in this in a short period of time, we're only doing security. So can we layer in confidentiality, availability, going into the third, fourth years? Can we layer in process integrity and privacy into the into the program so we build a more robust security program? So you you mentioned there's different ways to kind of build those the maturity of your security program here. Different ways, as you mentioned, more controls coming in in scope. Another way is also just assessing the maturity of the current controls you have in place. For teams that are leaner, so looking at a size, maybe a small solid, and we have a team of three, resource constraints are different things you also have to think about. What are some of the items that you would suggest that they start focusing on in terms of what looks good for the next audit, what looks good for year two, year three, and beyond? Yeah. You have to look at what's going to actually improve my security. Right? And so keeping up to date with your vulnerability management program, making sure that you are testing not just, quarterly vulnerability scans. Can you get it down to monthly? If you're at monthly, can you get it down to weekly? Right? What's your SLAs for managing your vulnerabilities? Are you currently at thirty days for high, 60 for for mediums? Can you cut that in half? Challenge yourself to to do better. That way, you you know, the process is there. Right? If the process for vulnerability scans happens on a weekly basis, that drives your patch management process, and then, hopefully, you can you can do better each time, you know, throughout each audit cycle or maybe, you know, whatever the cadence of of reviewing it. So, Hori, for you, I'll turn this back over to you. I imagine the the one of the driving factors for you to get a SOC two re report in hand, be HIPAA compliant, be HITRUST compliant, and get those attestations and certifications will support your trust to your customers. On your end, I imagine that you also expect the same from the vendors you work with. So what does your vendor risk, program look like? Your third party risk management program look like ever since you started engaging with Drata and engagement with, Bright Defense? Again, that's something that we have in place that it's that it's, that it's advising us when we actually did the, the last assessment. Right? Am I we we have an assessment done with the different vendors that we have. We certified that, you know, that they actually are compliant with SOC two, HIPAA, whatever other framework that we need them to be compliant with in order to be able to work with us, and all that information is being collected in Drata. And once that data is due to re to to be reevaluated, Drata is actually, you know, warning us, hey. You know, I need to get, fresh information about the spenders that you're currently working with. Can you provide me the, the the the latest information? And it also ranks the the, the vendors based on all the information that we provided to the system, whether they are high risk, low risk, and what kind of access do they have, and, you know, allows us to, you know, do those, assessments in a timely fashion. So due diligence on your end has also been an important fact. Would you say and as part of this control maturity then, have you increased the number of vendors that you actually manage on a yearly basis, or have you increased the cadence of, reviews that you do with vendors? Where have you prioritized, like, the the sort of maturity of your controls related to vendor management? I think we have probably, you know, more or less the same amount of vendors. I mean, like, there's not that many changes that, that we encounter, but, we do have, you know, the ability again to be able to say, okay. You know, it's it's time to do a reassessment of this vendor and, you know, start preparing beforehand, you know, couple couple months even even a couple months before it's actually due to be able to, you know, provide all the information that's required and, you know, ensure that we are, you know, compliant. And and our our assessors come back and say, like, yep. You know, everything looks good. So you mentioned a couple of months before you already have that insight into, hey. There's a vendor review that's due. I need to get on top of this so that, you know, we're not chasing it after the fact. Right? We're getting. on top of really early, which is a a good thing to do here. In the same light then, because all these are also then tied to risks, how is the majority of your risk management, your risk program in itself, come as a result of all of this? Again, I think, like like you mentioned previously, Am I we're not being, reactive anymore. Am I we're actually being proactive. Am I we have, you know, so many things in place, and we have, you know, checks checkups on on on on a on a very frequent cadence. So instead of actually having, you know, to investigate or find out that we're not compliant on, you know, fifty, sixty items, we find out that we're not compliant in two or three. So we can, you know, tackle those, you know, right away, and we continue to be compliant, and we just continue monitoring. And, Tim, on your side of as an MSSP, what are some of the items that you actually help out to focus on when it comes to the risk register in terms of finding the right risks, analyzing those risks, making sure they have a remediation plan in place for those. What are the sort of the advices you give teams around that? Yes. We've kinda touched upon a minute ago with vendor risk. Right? The most important thing there is, like, scoring the vendor by the the criticality, right, of, any kind of impact that, and risk level. What kind of information is this vendor storing for us? What are they processing? Where is it being processed? So making sure that that information is is is been documented in Drata. And then as Jorge mentioned, doing the annual reviews. Right? But also as, they they have new vendors, you know, doing the due diligence and also kinda returning the favor of sending questionnaires back to potential vendors, that they want to work with and scrutinizing their security posture before we bring them them on board. So we kinda look at that external risk kind of, third party risk management, and then we look at that kind of enterprise risk side. Right? What are things that are affecting the program? Obviously, technology is changing at a rapid speed with AI and all these other tools. How does that affect, what they're doing at SC print? What are some financial risks, that that that, are out there that could be, you know, whether it's IT or not. Right? So we're trying to take a holistic view of the enterprise's risk and make sure that these are documented in our risk register. A lot of our customers come to us, and they they're afraid to tell us, you know, something is the skeleton's in the closet. Right? But at a certain point in the partnership, all the skeletons come out and, you know, we're that trusted adviser that they could talk to. And a lot of these things, we tell them, like, look, we may not have a plan to remediate right now. We may have admin access on our employees' laptops, but, you know, we identify these things and we put them on our risk register, and we understand that this is a risk now, and we're working towards a remediation plan. Right? So a lot of companies often know view risks, and I'll turn it to specifically the enterprise risk, internal risks as a once at a time thing. Right? We do this yearly. We'll probably get to it the same time next year and just make sure we have a new risk register built out. Is that necessarily the right approach? And, again, tying this back to control maturity I was speaking of. How can they ensure that the risk program is actually something that's living and breathing and supports them in their in the whole GRC function? You want me to take that on first, Jorge? Sure. So we have excuse me. We approach it in in in different manners. We have that annual kind of risk assessment that's formalized so that we can document that as as the formal date of when we conducted this, risk assessment. But through conversations that we have with, like, Jorge and team and customers in general throughout the whole engagement, we're documenting things that just come out of natural conversation. Right? That, you know, Jorge expressed this concern, maybe a migration of this platform or that, Whatever it is that that, happens in the conversation, we're documenting these things. And so, we're trying to keep the risk register updated every quarter. You know, this thing gets refreshed, but, formally, we do it annually. So, Hori, on your side then, how does it come about resurfacing a risk? Right? I think Tim made the allusion to conversations that happen, over the course of time. Do you have a formal security team that, you know, kind of goes in and identifies risks, tries to understand the organization to to see where a risk might live so that they can pull it into a risk register. What does that program look like for you? And, actually, what what we have in place is we have different tools, you know, like running vulnerability scans on a on a on a very, well, on a week in a weekly cadence, actually, you know, like Tim mentioned. I mean, like so, you know, it it it allows us to be able to identify those risks, pretty, pretty quickly. I mean, we do penetration testings as well. You know, on a quarterly basis, we can do it more often if we if we needed to. But, again, the vulnerability scans are the ones who actually, you know, surface any of the, potential risks that we need to address right away. Okay. So just to close this chapter on, maturity of controls and the likes, In your opinion, Tim, and as simply as you can put it, what does a realistic control maturity plan look like for a company? I'm gonna give you this data. It depends. Right? It's it's hard. There's no kind of one size fits all. It's important to tailor this to kind of the company's kind of budget, flexibility to implement changes, right, and and size. You know, the larger the organization, obviously, the larger the more time it's going to take to implement these things. So we have to break it down into, measurable chunks and milestones. Right? We're not gonna go from level one to level four, you know, overnight. It's gonna take time to progress this thing. But, have have we are we able to get, you know, buy in from the executive team on down to make these changes, right, that are going to improve our security posture? And if it's not going to improve our security posture, why are we doing this? Right? And so we have to keep evaluating that, because otherwise yeah. Trying to achieve level four for every control, it it's not realistic, you know, in a short period of time. This is a living and breathing security program, and so we just have to make sure we prioritize the things that are gonna be the most effective to the organization. I'm sorry. So this goes to you. Tim made, alluding to something that's very important. So So our security bring a top down exercise. So on your part, how do you ensure that you bring in your leadership into these conversations, ensure that you get the buy in for all these different decisions that need to be made to ensure that your security program is as robust as it can be, to meet the objectives that it it has to. Well, in the past, I mean, like like I said like I said, we had everything in spreadsheets and whatnot. I'm like and it was it was more of, like, my word saying, like, everything is it was is is under control. Everything is good to go. I'm like, you don't have to worry about it. But now we actually have dashboards that we can show them, and they can actually visualize what is going on and and, how close or what the percentage of compliance do we have actually in place. And I can show them the different controls. I can show them, you know, where we're fully compliant. It's it's it's it's older. I'm like, I can do a a full presentation deck to them that, allows them to see, you know, that the system is in place, that it's working, and that it's something that it's living and breathing like Tim said. You know? It's something that it's continuously being monitored and changing and adjusted as we need it. Alright. So you mentioned, you know, bringing them in, showing them dashboards. Do you also show them kind of trends of things over time just so that they have an idea of how, the maturity process is growing so they understand where the investments are being put? Are those sort of things that they wanna see, and are those sort of questions that they are asking as well, to understand? Absolutely. Absolutely. I'm not looking at, you know, as an example, as hard hardware that we used to have in the past, and I'm like, you know, what it actually took to actually, you know, invest in new hardware and spin up new VMs or whatever may whatever the efforts may have been, to ensure that our that our environment was up to date and and secure. So, you know, that actually shows them, you know, we were at this point here where we're not compliant at all, and now we're at this point where we're fully compliant. And, you know, even though changes keep happening, we can continue to evolve with the changes and stay compliant. So to both Tim and Johore, we mentioned, at the beginning how you have a a an information security manager that's assigned to a customer. They meet on a biweekly, cadence to just make sure that things are being remediated in time. We're, identifying gaps, remediating those gaps. As you get through the process, as you go past that, you know, first SOC two audit, SOC two type two especially, does that cadence remain the same? Does it look slightly different? I'll I'll let you start then. I can build on that question. Yeah. It it it can remain the same if that's kind of the preference, from from the team, you know, or various customers have different kind of requirements. Sometimes if things we can, get done asynchronously, you know, evidence collection and all those things, we we made to kinda take that and do it asynchronously so we can focus on strategic things in the conversations that we have in real time. That way we can, actually consult. Right? We can advise on on how to, achieve the next goals that we're trying to achieve and set those and and get the cadence working on that side versus the maintaining is done more asynchronously. So, it's just about the rhythm that we're trying to build and setting kind of whatever the weekly tasks are, monthly and semiannual annual tasks, right, and kind of building out that project plan ahead of time so you could see what what you could preview ahead of time what's expected. Right? Keeping up to date with our quarterly access reviews, all of the tabletop exercises. Right? We're not doing that on one call. We're spreading that out throughout the year, and so it makes, managing the compliance program kind of just done in chunks, and, eventually, we we we finish that that full marathon. So I imagine, in a nutshell to put it then, it's first, we wanna build the habits. Then we wanna ensure that these habits are actually being maintained. And once that habit is maintained, then we wanna move on to the strategic conversations of this is what we should be focusing on to to ensure that the maturity continues to grow across the security program. Would you put it any other way, Hari? Do you have any comments on that, or is that a first assessment of this all? No. I think he, hit the nail right on the head. I'm like, that's a perfect, explanation that Tim gave. So I just wanna take it back to one item because I know we covered a lot on the pieces that Drata helps automate. Right? So we have the controls, we have the cross mapping, we have the monitor controls where we're able to pull evidence from slides. But there's also a a part of the function that lives outside of Drata, which is the non monitored events. Right? So you have certain controls where Drata is unable to to gather evidence on your behalf. How do you go about maintaining such evidence, periodically for the manually pulled evidence? basically, we, we make sure that we identify what, you know, what type of evidence that we need to be collecting. I mean, and that's a collaborative collaborative, work between us and, and Bright Defense. I mean, we keep that information in our project management tool and basically saying, hey. You know, we need, as an example, we need, you know, evidence on on access control. I know it can show me, you know, which which servers are being accessed and by whom. I'm like, so we can pull that information with no problem and, and and get exactly what's being asked for. So that that's that's the beauty of being able to work with, you know, Bright Defense that, you know, not only they they can point us to what we need, but we can come up to a a consensus of, okay. We have the right information that the that the auditor is gonna be looking at. And, you know, placing it in Drata, placing it into the control, and we're done. Even though if it's not automate automated, Mike, it's easily taggable and, you know, attached to that specific control that we're looking for. So I guess there's key things that come out of that. Right? One, understanding who owns what, understanding when, something needs to be done and by, you know, who needs to do what by when they need to do it, and then just ensuring that it's completed in due time. Right? All those three elements kinda kinda come together seamlessly. Awesome. Correct. Well, I know we're out of time. I just wanna get in the floors for you guys. Any last statements before we go ahead and take any q and a's, any key takeaways you wanna share with the the rest of the audience here today? I think I'm like my my my key takeaway is, like, are pretty much there, you know, pretty bright and clear. I mean, like, again, you know, I've I've mentioned this before. The Drata is not just an audit tool. I'm like, it it helps us, you know, monitor our compliance all year round, you know, consolidating our different frameworks in one to one plat platform, not, you know, not, not duplicating the work and and compressing the timelines. You can get things done faster, continuous monitoring, the safe base of the trust, trust center. I mean, that's that's been invaluable, you know, to our to our to our different vendors that we work with. They can go and grab the information and obtain it themselves instead of, you know, having to ask, for it from us. And and sometimes they they come in they come in for a little more, but for the most part, they're they're very well satisfied with what the trust, center is actually providing them. And compliance reporting to the leadership team, I'm like, it's it's now very easy. It's a narrative. I'm like, easy to do. I'm not not a not a big deal, and and credibility stays, you know, factual all the time. I like the last statement there. Credibility stays factual all the time. And I think that's all what all companies wanna do, portray trust, to all companies that wanna work with them. Tim, any last words from you? Yeah. I think, you know, Jorge summed it up great. For me, it's more of that, using the tool, using Drata as as a compliance automation. That's just one aspect of it. But, you know, if you can use a tool to actually build a strong security program, that's a way to leverage, you know, the whole, the ecosystem of of what Drata offers and the partnerships that they offer, to build a well rounded security program. You know? For us, it's about making sure that our customers don't get breached, not just a piece of paper that that just kind of revalidates that that these things are in place. That's the most important So first to say, data station is just the baseline. Right? What we need to do is then focus more on building the program, thing. ensuring the program matures, and just making sure that we have all the relevant materials to support that program evidence at the time of an audit. Yes. The the last statement as well tying it back to Horry, ensuring that we can all portray this to vendors, customers, investors, and everybody alike who wants to see that we are doing the right things, and they wanna be able to trust the information we're sharing with them. Well, thank you guys all for this engaging conversation. This has been very informative for me. I see here no questions came in, so I imagine, like, you know, we we covered across across the board what needed to be heard. But I'll invite the audience. If ever any questions come up, please feel free to share with us. We can always go back to Tim, Jorge, get some advice from them specifically to address those, questions you have. But thank thank you guys for your time once again. I appreciate you lending your voice here. Wish you all the best in your continued success there, Jorge, with, the continuous of your SOC two program, especially as you finish your SOC two type two and get that first, huge milestone, finished there. And, Tim, thank you for the continued partnership. We we look forward to growing that. Thank you guys both. Thanks, Jordan. you. Thanks, Jorge. Take care, guys. Have a good day, everybody.