Automated Evidence Collection Integrations FAQ

The automated evidence collection tool allows you to configure third-party integrations to automatically collect evidence using the new Evidence Integrations menu within Compliance Automation. The tool allows you to activate pre-architected end-to-end collections to document evidence on time and in scope for your compliance initiatives to help automate evidence collection and ensure security controls are in place, continuously. These integrations help to save you time and resources by automatically collecting evidence on your behalf. Each type of integration addresses different use cases, and the more integrations you set up, the more evidence will be collected. For more information, see Configuring Automated Evidence Collection.

We have compiled a list of frequently asked questions to help auditors understand the measures Automated Evidence Collection has implemented to ensure we provide complete and accurate data.

Frequently Asked Questions

What is an Automated Evidence Collection integration?

An automated evidence collection integration is an Application Programming Interface (API) integration that connects the platform with another application. This connection allows the two applications to communicate with one another, and it enables the collection of evidence to satisfy the evidence tasks in your compliance initiatives.

The collected evidence is compiled into a report that you can use to address a specific evidence task in your readiness project. Each satisfied evidence task supports at least one of your implemented controls or policies, and this brings you one step closer to completing your readiness project.

How do integrations help you complete Compliance Automation initiatives?

Automated evidence integrations automatically collect evidence from other applications. The collected evidence is compiled into a report that you can use to address a specific evidence task in your compliance initiative. Each satisfied evidence task supports at least one of your implemented controls, and this brings you one step closer to completing your compliance initiative.

Which integrations are supported by Automated Evidence Collection?

Automated Evidence Collection provides over 50 collectors across 30 systems to help customers collect evidence for different categories of controls. For more information, see the full list of implemented integrations and associated evidence tasks.

How do I know if an integration is pulling the correct information?

Automated Evidence Collection provides step-by-step instructions to set up each integration. Once the user has followed the instructions and configured the integration, the integration will fetch all of the target data. If there are any issues with network or user credentials, then the integration will not bring any data. So an integration is set up to fetch all or none; hence Automated Evidence Collection and the user will know if the integration is giving errors.

For more information, see Configuring Automated Evidence Collection.

Has Automated Evidence Collection implemented any measures to identify errors in integration processing?

Yes. Automated Evidence Collection’s experienced engineers support integration operations. Any issues with the working of these integrations get notified, recorded and timely resolved.

How does Automated Evidence Collection ensure an integration is fetching complete and accurate data?

Automated Evidence Collection tests every integration in the test environment before migrating it to production. During the testing process, Automated Evidence Collection checks to ensure an integration is configured to pull the correct data, which is complete and accurate to meet the Evidence Task requirements.

Can an integration be modified once it is configured? Can an integration’s output be modified?

Automated Evidence Collection allows customers to update the configuration setup anytime they want (e.g. frequency of collection). However, the output file or data generated through the integration is non-modifiable on the Automated Evidence Collection platform.

How does Automated Evidence Collection ensure the integration’s API code is secure?

Automated Evidence Collection follows a robust change management and access management process to ensure access is restricted and that the production code cannot be directly modified. If Automated Evidence Collection updates the API code for an existing integration, we make sure to announce it to customers.

Besides, Automated Evidence Collection encrypts the customer credentials in the database to ensure security and confidentiality.

Can my auditors rely on the reports generated through the integrations?

Yes. Automated Evidence Collection has put all measures in place to ensure it satisfies Automated Evidence Collection’s internal controls requirements to provide customers and their auditors assurance over processing integrity. You can download automated evidence collection (AEC) sample reports as Excel files to view the test data available for all evidence integrations. For more information, see Downloading Sample Reports.

We also include “Processing Integrity'' (see note below) as one of the Trust Service Categories in our SOC 2 report, which can be obtained on a request basis.

Note:

Processing integrity refers to system processing to be complete, valid, accurate, timely, and authorized to meet the entity’s objectives. The processing integrity addresses that there are no errors in processing, and if there are, they are detected timely and corrected. Additionally, the processing integrity addresses that outputs are accurate, and data is securely stored and maintained.

Implemented Integrations and Associated Evidence Tasks

Each integration (system) can have multiple collectors. Each collector creates one report and is associated to a single evidence task. The collectors support the following use cases across each integration:

System

Collector / Service

Associated Evidence

AWS CloudTrail

Cloud logs

Activity Logs:

Connect to your Amazon CloudTrail to collect activity logs.

  • System Event Logging and Monitoring

AWS CloudWatch

Cloud logs

Performance and Availability Logs:

Connect to your Amazon CloudWatch to collect performance and availability logs.

  • System Availability Logging

AWS DynamoDB

Cloud database configurations

Backup Configuration Collection:

Connect to your Amazon DynamoDB to collect backup configuration.

Encryption Configuration Collection:

Connect to your Amazon DynamoDB to collect encryption configuration.

  • Backup Schedule

  • Data Encryption at Rest

AWS EC2

Cloud storage configurations

Encryption Configuration Collection:

Connect to your Amazon EC2 instances to collect encryption configuration.

Security Group Rules:

Connect to your Amazon EC2 instances to collect security group rules.

  • Data Encryption at Rest

  • Firewall Configurations Settings

AWS IAM

Cloud IAM configurations

IAM Report:

Connect to your Amazon IAM to collect User/Role configuration.

Infrastructure Password Configuration:

Connect to your Amazon IAM to collect infrastructure password policy configuration.

MFA Settings:

Connect to your Amazon IAM to collect MFA settings.

  • Population 15 - List of Users with Access to Application and Infrastructure

  • Configuration for Infrastructure Password

  • Enabled Multi-Factor Authentication

AWS Lambda

Cloud compute configurations

Serverless Functions Configuration Collection:

Connect to your Amazon Lambda to collect the serverless function configuration.

  • List of Serverless Functions

AWS RDS

Cloud storage configurations

Backup Configuration Collection:

Connect to your Amazon RDS instances to collect backup configuration.

Encryption Configuration Collection:

Connect to your Amazon RDS instances to collect encryption configuration.

Security Group Rules:

Connect to your Amazon RDS instances to collect security group rules.

  • Backup Schedule

  • Data Encryption at Rest

  • Firewall Configurations Settings

AWS S3

Cloud storage configurations

Cloud Backup Configuration Collection:

Connect to your Amazon S3 account to collect cloud backup configuration.

Encryption Configuration Collection:

Connect to your Amazon S3 account to collect encryption configuration.

  • Backup Schedule

  • Data Encryption at Rest

AWS VPC

Cloud network configurations

Network Access Control List:

Connect to your Amazon VPC to collect network access control list.

  • Firewall Configurations Settings

Azure Blob Storage

Cloud storage configurations

Encryption:

Connect to your Azure Storage Accounts to collect encryption configuration.

  • Data Encryption at Rest

Azure Cosmos DB

Cloud database configurations

Backup Configuration Collection:

Connect to your Azure Cosmos Databases to collect backup configuration.

Encryption Configuration Collection:

Connect to your Azure Cosmos DB to collect encryption configuration.

  • Backup Schedule

  • Data Encryption at Rest

Azure Disks

Cloud disks configuration

Encryption:

Configuration Collection: Connect your Azure Disks to collect encryption configuration.

  • Data Encryption at Rest

Azure Firewalls

Cloud network configurations

Firewalls:

Connect your Azure Firewall to collect firewall rules.

  • Firewall Configurations Settings

Azure Function App

Cloud compute configurations

Serverless Functions Configuration Collection:

Connect to your Azure Function App to collect serverless function configurations

  • List of Serverless Functions

Azure IAM

Cloud IAM configurations

IAM Report:

Connect to your Azure account to collect your IAM report.

  • Population 15 - List of Users with Access to Application and Infrastructure

Azure Monitor

Cloud logs

Activity Logs:

Connect to your Azure Monitor to collect activity logs.

Performance and Availability Logs:

Connect to your Azure Monitor to collect performance and availability logs.

  • System Event Logging and Monitoring

  • System Availability Logging

Azure Network Security Groups

Cloud network configurations

Network Security Rules Collection:

Connect to your Azure Network Security Groups to collect security rules

  • Firewall Configurations Settings

Azure SQL Server

Cloud database configurations

Backup Configuration Collection:

Connect to your Azure SQL servers to collect database backup configuration

Encryption Configuration Collection:

Connect to your Azure SQL DB to collect your encryption configuration collection

  • Backup Schedule

  • Data Encryption at Rest

Bitbucket

Code repository configurations

Code Review:

Integrate with Bitbucket to retrieve evidence of Code Reviews.

  • Code Review Results

CrowdStrike

Workstation firewall

Workstation Firewall:

Integrate with CrowdStrike to retrieve Workstation Firewall evidence.

  • Workstation Anti-malware Settings

Datadog

Incident monitoring

Incident Monitoring:

Connect with your Datadog account to collect evidence that you have monitoring/alerting tools in place to identify and detect anomalies that could compromise the availability of system operations.

  • Population 5 - List of Security Incidents

GitHub

Code repository configurations

Collect Pull Requests:

Connect with your GitHub account to collect pull requests for a repository and branch.

  • Code Review Results

Google Cloud Compute Engine

Cloud compute configurations

Storage Disk Encryption Configuration Collection:

Connect to your Google Cloud Compute Engine to collect storage disk encryption configuration

  • Data Encryption at Rest

Google Cloud Firewall

Cloud network configurations

Firewalls:

Connect with your Google Cloud Firewall to collect the firewall rules.

  • Firewall Configurations Settings

Google Cloud IAM

Cloud IAM configurations

IAM Report:

Connect to your Google Cloud IAM to collect IAM Role configuration.

  • Population 15 - List of Users with Access to Application and Infrastructure

Google Cloud Functions

Cloud compute configurations

Serverless Functions Configuration Collection:

Connect to your Google Cloud Functions to collect serverless function configurations

  • List of Serverless Functions

Google Cloud Logging

Cloud logs

Activity Logs:

Connect to your Google Cloud Logging to collect activity log.

  • System Event Logging and Monitoring

Google Cloud Monitoring

Cloud logs

Performance and Availability Logging:

Connect to your Google Cloud Monitoring to collect Performance and Availability logs.

  • System Availability Logging

Google Cloud SQL

Cloud database configurations

Encryption Configuration Collection:

Connect to your Google Cloud SQL servers to collect encryption configuration.

  • Data Encryption at Rest

Google Storage Buckets (GCS)

Cloud storage configurations

Buckets Encryption Configuration Collection:

Connect to your Google Cloud Storage Buckets to collect encryption configuration.

  • Data Encryption at Rest

Jamf Pro

Workstation configurations

Workstation Antivirus:

Connect with your Jamf Pro account to collect evidence that your workstations are running Antivirus software.

Workstation Disk Encryption:

Connect with your Jamf Pro account to collect evidence that your workstations have disk encryption enabled.

Workstation Firewall:

Connect with your Jamf Pro account to collect evidence that your workstations have firewall settings enabled

Workstation Password Configuration:

Connect with your Jamf Pro account to collect evidence that your workstations require secure passwords.

  • Workstation Anti-malware Settings

  • Workstation Disk Encryption Settings

  • Workstation Firewall Settings

  • Workstation Passwords

JIRA

Ticketing configuration

Customer Support Tickets:

Integrate and access info in Jira to collect customer support tickets.

Infrastructure and Application Changes:

Integrate and access info in Jira to collect infrastructure and application changes.

  • Customer Support Tickets

  • Population 3 - List of Infrastructure and Application Changes

Microsoft Intune

Workstation configurations

Workstation Antivirus:

Connect with your Microsoft Intune account to collect evidence that your workstations are running Antivirus software.

Workstation Disk Encryption:

Connect with your Microsoft Intune account to collect evidence that your workstations are using disk encryption.

Workstation Firewall:

Connect with your Microsoft Intune account to collect evidence that your workstations are running Firewall software.

Workstation Password Configuration:

Connect with your Microsoft Intune account to collect evidence that your workstations require secure password.

  • Workstation Anti-malware Settings

  • Workstation Disk Encryption Settings

  • Workstation Firewall Settings

  • Workstation Passwords

Zendesk

Ticketing configuration

Customer Support Tickets:

Integrate and access info in Zendesk to collect customer support tickets.

  • Customer Support Tickets