About

Collecting evidence by hand takes a lot of time, and it has to be repeated every audit cycle. ControlMap can do much of it for you. You connect the tools where your evidence already lives, and ControlMap collects their data on a schedule, runs automated compliance checks, and keeps your people records up to date.

This article explains what ControlMap can automate, how the automation works, where you see the results, and what still needs a person. For the steps to connect a tool, see the Connect an integration article.

What ControlMap can automate

Each tool you connect is called an integration. These are the kinds of tools you can connect:

• Cloud infrastructure (AWS, Azure, Google Cloud): runs cloud security checks. AWS and Azure also bring in cloud resources as assets, and Azure brings in directory users as user accounts.
• Source control and development (GitHub, Azure DevOps, Snyk): GitHub checks member MFA, repository access, branch protection and how recently secrets were updated. Azure DevOps brings in the people with access to your organization. Snyk brings in a project's vulnerability findings.
• Identity providers (Microsoft, Okta, OneLogin, Jump Cloud, Duo, Google Workspace): bring in user accounts, who is an administrator, and whether MFA is set up. They run checks such as "All user accounts in Google Workspace must have MFA enrolled". Microsoft also brings in Intune devices as assets, and Jump Cloud brings in devices too.
• HR systems (HR System, Bamboo HR, Zoho): bring in your employees as people records.
• Background checks (Checkr) and security awareness training (KnowBe4): bring in whether each person has completed their background check or training.
• Devices and assets (Auvik, Nodeware): bring in devices as assets. Nodeware also brings in their vulnerabilities.
• Logging (Datadog): checks that logs, monitors and incident tracking are in place.
• Collaboration (Slack User Access): brings in workspace members with their admin status and whether two-factor authentication is on.
• Work tools and documents (Jira, Asana, Google Drive): attach Jira issues from a saved search, Asana tasks from a project, or the files in a Google Drive folder as evidence on the controls you choose.

The tools available to you are listed in Monitor › Integrations › Add Integration. A tool that isn't available yet is greyed out and listed last.

How the automation works

Every connected tool follows the same cycle:

1. You connect the tool and choose which automated checks it runs.
2. ControlMap scans the tool on a weekly schedule. You choose the Day of the week and the Time of the day. To scan sooner, open the connection and select Run Once.
3. The data the scan collects appears in the Monitor tabs, mixed in with the data from your other connections.
4. Each compliance check is mapped to controls and objectives, so its result becomes evidence on them.
5. The people you chose as watchers are notified when the connection's status changes. You are added as a watcher by default.

Scan results and evidence are kept for 180 days, and each scan keeps its history. A check shows "No Data" until its first scan has finished.

See what was collected

Your automated data is in Monitor. It has these tabs:

• Dashboard: six summary tiles (System health, Open findings, MFA coverage, Asset health, Background checks and Awareness training) and six cards below them. The Background checks and Awareness training tiles show data only when a background check or training tool is connected.
• Compliance Checks: every check with its Status (Passing, Failing, Error or No Data) and the controls and objectives it is mapped to. To see the proof behind a check, open its menu and select View Evidence.
• Assets: the assets your tools found, with the pass and fail results of the checks on each.
• Vulnerabilities: the vulnerabilities your tools found, with their severity and status.
• User Accounts: the accounts your tools found, with their MFA status and whether they are administrators.
• Integrations: where you connect and manage your tools.

On the Assets, Vulnerabilities, User Accounts and Compliance Checks tabs, the Integration column and filter tell you which tool supplied each row.

Evidence created by an integration is shown as that integration's compliance report instead of a list of requests. On an objective, it sits under "Automatic system monitors", apart from "Manual evidence".

The User Accounts tab links each account to a person in People. An account with no linked person is an orphan account.

Keep your people up to date

HR and identity tools can keep your list of people current without manual entry. After you connect one, ControlMap creates and updates people for you, and the Provider column in People shows where each person came from.

• HR systems: Bamboo HR, Zoho and HR System create or update people from your employee records. With Bamboo HR, a person with a termination date becomes Terminated, and an Inactive person becomes Disabled.
• Identity providers: on tools such as Okta and Duo, tick Setup emails discovered as employees in ControlMap and each email the tool finds becomes a person.
• Background checks and training: when Checkr or KnowBe4 reports a completed check or passed training for a person already in People, their Background Check or Security Training flag is turned on.
• Invitations: on the tools that offer it, tick Invite employees to Compliance Portal and each new email address ControlMap finds is invited to My Compliance Portal.

You can also add people by hand or import them from a CSV file. See the People article for those steps.

Stay in control of what is automated

Automation doesn't have to be all or nothing. You can decide what counts:

• Checks: on Monitor › Compliance Checks, an Enabled / Disabled switch turns a check off. A disabled check is greyed out and shows no status.
• Assets: on Monitor › Assets, you can turn checks off for an asset. ControlMap asks for a reason and shows it under the switch.
• Accounts: on Microsoft connections, the Inclusions & Exclusions step lets you include or exclude accounts by email, email pattern, group name or group pattern. Excluded accounts leave the sync altogether.
• Mappings: use Manage Mappings in a check's menu to change which controls it counts toward.

Disabling a check or an asset keeps its record but stops it counting in your compliance results.

Automate the evidence people provide

Some evidence can't come from a connected tool, such as documents, links and notes. You can still automate when it is requested by making the evidence repeat:

1. Go to Evidence and open the evidence item.
2. Select Collection type to open "Configure Evidence Collection Schedule".
3. Set the start date and the repeat pattern.

New requests then appear on the Scheduled sub-tab ahead of time and become active as they come due, each with its own assignee, due date and status. To start a new cycle straight away, tick evidence rows and select Refresh evidence, then choose the due date for the new requests.

Where to start

Every organization has a different mix of tools, so how much you can automate varies. Common places to start are:

• Your cloud infrastructure.
• Your HR system.
• Your identity provider.
• The tools that report your devices and assets.

Policies, procedures and similar documents will still be provided by your team. Give the evidence that depends on them a repeating schedule so proof stays current.