Platform · Integrations and automation

Technical evidence comes from connected systems and is checked every day.

EVIDEVO connects to the systems already in use: identity and access, cloud, devices, endpoint security, ticketing, development, HR. From each system it reads configurations and lists, stores them as evidence with date and source, and compares them with the control parameters. If a parameter is not met, the test fails and the owner is alerted. Evidence that does not come from a system is still uploaded manually.

Let's talk Starting assessment

Data for illustrative purposes only, not real

The problem

01

Screenshots and manual exports

Every piece of technical evidence needs a manual extraction and only describes the status on the day it was taken.

02

Controls checked once a year

Between two audits there is no way to know whether MFA is still enabled on every admin account.

03

Systems kept apart from compliance

Ticketing, HR and cloud hold data that could serve as evidence, but stay disconnected from the control register.

What it does

Connectors to company systems: technical evidence collected and technical controls checked every day.

  • System connectors

    Identity and access, cloud, devices, email, ticketing, HR, vulnerability management.

  • Automatic evidence collection

    Configurations, user lists and reports are read from systems and stored as evidence, with date and source.

  • Daily tests

    Technical controls are checked every day: MFA, encryption, backups, inactive accounts.

  • Alerts on failed tests

    When a test fails, the owner is alerted with the non-compliant item, for example the account without a second factor.

  • Corrective actions as tickets

    Corrective actions can be raised as tickets in the ticketing tools already in use.

  • APIs

    For connecting internal systems and in-house tools, with controlled access.

Connectable systems

Systems that can be connected, by category, and what is checked in each.

  • Identity and access

    • Microsoft Entra ID
    • Google Workspace
    • Okta

    MFA enabled, inactive accounts, administrators, leavers.

  • Cloud

    • Microsoft Azure
    • AWS
    • Google Cloud

    Encryption, backups, active logging, exposed resources.

  • Devices

    • Microsoft Intune
    • Jamf

    Disk encryption, updates, active protection.

  • Endpoint security

    • Microsoft Defender
    • CrowdStrike
    • SentinelOne

    Agent coverage and open incidents.

  • Ticketing and alerts

    • Jira
    • ServiceNow
    • Microsoft Teams

    Corrective actions as tickets, alerts to the owner.

  • Development

    • GitHub
    • GitLab

    Code review, branch protection, exposed secrets.

  • Vulnerabilities

    • Tenable
    • Qualys

    Periodic scans as evidence, open critical vulnerabilities.

  • People

    • HR and payroll systems

    Joiners and leavers, to link people, access and training.

Other systems can be connected through APIs or on request.

The outcome

  • Technical evidence with date and source system, without screenshots
  • A daily outcome for every automated technical test
  • An alert to the owner for every failed test, naming the item to fix

Related frameworks

Other capabilities

A thirty-minute presentation based on the organisation's scope.

It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.

Let's talk