Making yourself audit-ready with Verae DataCubes
================================================

.. only:: html

   .. image:: _static/VeraeFullLogo.png
      :width: 280px
      :alt: Verae
      :class: logo

.. raw:: latex

   \thispagestyle{plain}
   \vspace*{0.15cm}
   {\LARGE\bfseries\color{veraepurple}Executive summary\par}
   \vspace{0.85em}
   \addcontentsline{toc}{chapter}{Executive summary}

Software alone does not make an organization HIPAA certified, SOC 2
attested, or ISO 27001 certified.

That sentence is the point of this document. It is also the sentence
that is most often skipped when a vendor, an integrator, or an internal
champion shows encryption, hashing, or a pentest PDF and treats the
conversation as finished. It is not finished. Encryption is a control.
A pentest is an evaluation of a component. A certificate, an attestation,
or a covered-entity determination is a statement about **an organization**
--- its legal entity, its people, its written policies, its operating
procedures, its internal controls, the evidence those controls produce,
and the independent party that examined that evidence.

The Verae DataCube Solution gives an organization tools to **store**,
**communicate**, **timestamp**, **verify**, and **audit** for compliance.
Those tools are real, they are specific, and they are described in the
chapters that follow. They are still only tools. To obtain HIPAA-aligned
status as a covered entity or business associate with a defensible
program, a SOC 2 Type I or Type II report, or an ISO 27001 certificate,
the organization must still:

* write and live by **policies** (what the organization says it will do);
* operate **procedures** (how staff actually do it, every day);
* design and test **internal controls** (the checks that catch failure);
* retain **evidence** (logs, tickets, screenshots, signed approvals,
  restore tests, training records);
* engage an **independent auditor**, CPA firm, or ISO registrar, as the
  chosen program requires.

Verae cannot issue those certificates. Verae cannot sit in the
organization's chair during an OCR investigation, a SOC 2 fieldwork
week, or an ISO Stage 2 audit. What Verae can do --- and what this
briefing is written to make precise --- is provide the **tools**, the
**background**, and the **software infrastructure** that make it easier
to implement the **technical portion** of those programs.

.. raw:: latex

   \clearpage
   \tableofcontents
   \clearpage

.. toctree::
   :maxdepth: 2
   :numbered:
   :caption: Contents

   what-verae-provides
   datacube-server
   data-in-transit
   data-at-rest
   timestamped-receipts
   peergos-eu-evaluations
   global-timestamping
   iceberg-archive
   architecture
   baa-dpa
   checklist
   howto
   bio-james-garfinkel
   bio-stuart-haber
   bio-george-lambert
   contact