WHAT'S INCLUDED

Through a Drata trusted vCISO/MSSP partner, Drata offers a quickstart program to all their customers for implementing Information Security Programs that leverage Drata as the foundation and baselinefor all infosec and compliance requirements.

• PROJECT PLANNING A dedicated project will be created in the Partners project management system detailing services conducted and mutually agreed-upon deadlines.
  
• GAP ANALYSIS Partners will conduct a compliance gap analysis leveraging Drata's integrations based on the selected compliance frameworks to identify gaps across the organization.
• Services included
• Scope and customize compliance framework requirements and assign control owners (if applicable)
• POLICY CREATION / REVIEW
• Services included
• Build information security policies based on Drata policy categories (not just providing templates to be filled out)
  
• Leverage partner templates as a starting point, which has been designed and updated from the results of hundreds of succesful audits
  
• Establish all core policies that are categorically outlined in Drata
• Review customer's existing policies (that are within Drata's policy categories) and call out gaps
• Services NOT included
•  Build niche procedure documents.
• Combine partner-created policies with customer policies
• Guarantee every policy needed for every type of audit (auditors have different request lists, and some standards, like HIPAA and NIST, require careful curation of policies vs procedures)
• Handle more than one iteration of review changes from customer
• Project manage to ensure every policy is approved and acknowledged by all customer personnel.
• Review customer's existing policies that are outside the scope of Data's policy categories.
• SYSTEM DESCRIPTION DOCUMENTATION (*if pursuing SOC 2)
• For SOC 2 customers the Partners will guide the customer through creating this important document, ensuring it meets all standards.
• TABLETOP EXERCISE GUIDANCE AND RESTORATION TEST INSTRUCTION
• Partners will draft comprehensive security incident response and disaster recovery templates and provide instructions for customers to facilitate the successful completion of these mandatory tests.
• RISK ASSESSMENT SERVICES
• Partners will develop an effective internal risk assessment program in accordance with compliance standards and industry best practices. Risk assessment activities will consider the organization's people, business processes, data management, and technology.
• Services Included:
  
• Partners will develop and deploy a risk assessment framework based on industry best practices and compliance standards
• Partners will consult the company on risk evaluation and acceptance of the top 10 risks impacting the organization, as well as assign risk scores and owners to all identified risks.
• Provide guidance for risk remediation and treatment plans.
• PENETRATION TESTING
• Partners may offer a pen test at an additional discounted charge (based on scope).
• Partners can also assist the customers in selecting a suitable penetration tester that aligns with the client's environment and needs.
• AUDIT FIRM SELECTION
• Partners will assist the customer in evaluating and selecting a Drata-approved audit alliance provider that aligns with the customer's objectives and budget.
• Services only available upon upgrade
• This service is intended to ensure that you are achieving tremendous value from the Drata platform early on in your journey. While your implementation team can support your organization beyond the 30 day Compliance Accelerator service, this service does not include support on the following:
• Audit readiness for any compliance standard (i.e. SOC 2, ISO 27001, etc)
• Support on completing security assessment questionnaires (SAQ)
• Completion of an Incident Response Plan or support in any actual security incidents
• Completion of a Disaster Recovery/Business Continuity Plan
• Representation as your security or compliance team
• Security configuration changes for Cloud Infrastructure (AWS, GCP, Azure)
• Instant Messaging / Chat Support outside of Slack
• Building of custom frameworks or controls inside of Drata
• Migrations from another solution (this is handled by Drata's internal CS team)
• Editing current policies
• Employee onboarding / offboarding

UPGRADE FOR ADDITIONAL SERVICES

This service is intended to ensure that you are achieving tremendous value from the Drata platform early on in your journey. While your implementation team can support your organization beyond the 30 day Compliance Accelerator service, this service does not include support on the following: