George Lambert
8496ef8338
Some checks are pending
ci / markdown (push) Waiting to run
The cover stays page 1. Numbered chapters now start at What Verae provides. The TOC lists Executive summary at page 2.
81 lines
2.8 KiB
ReStructuredText
81 lines
2.8 KiB
ReStructuredText
Making yourself audit-ready with Verae DataCubes
|
|
================================================
|
|
|
|
.. only:: html
|
|
|
|
.. image:: _static/VeraeFullLogo.png
|
|
:width: 280px
|
|
:alt: Verae
|
|
:class: logo
|
|
|
|
.. raw:: latex
|
|
|
|
\thispagestyle{plain}
|
|
\vspace*{0.15cm}
|
|
{\LARGE\bfseries\color{veraepurple}Executive summary\par}
|
|
\vspace{0.85em}
|
|
\addcontentsline{toc}{chapter}{Executive summary}
|
|
|
|
Software alone does not make an organization HIPAA certified, SOC 2
|
|
attested, or ISO 27001 certified.
|
|
|
|
That sentence is the point of this document. It is also the sentence
|
|
that is most often skipped when a vendor, an integrator, or an internal
|
|
champion shows encryption, hashing, or a pentest PDF and treats the
|
|
conversation as finished. It is not finished. Encryption is a control.
|
|
A pentest is an evaluation of a component. A certificate, an attestation,
|
|
or a covered-entity determination is a statement about **an organization**
|
|
--- its legal entity, its people, its written policies, its operating
|
|
procedures, its internal controls, the evidence those controls produce,
|
|
and the independent party that examined that evidence.
|
|
|
|
The Verae DataCube Solution gives an organization tools to **store**,
|
|
**communicate**, **timestamp**, **verify**, and **audit** for compliance.
|
|
Those tools are real, they are specific, and they are described in the
|
|
chapters that follow. They are still only tools. To obtain HIPAA-aligned
|
|
status as a covered entity or business associate with a defensible
|
|
program, a SOC 2 Type I or Type II report, or an ISO 27001 certificate,
|
|
the organization must still:
|
|
|
|
* write and live by **policies** (what the organization says it will do);
|
|
* operate **procedures** (how staff actually do it, every day);
|
|
* design and test **internal controls** (the checks that catch failure);
|
|
* retain **evidence** (logs, tickets, screenshots, signed approvals,
|
|
restore tests, training records);
|
|
* engage an **independent auditor**, CPA firm, or ISO registrar, as the
|
|
chosen program requires.
|
|
|
|
Verae cannot issue those certificates. Verae cannot sit in the
|
|
organization's chair during an OCR investigation, a SOC 2 fieldwork
|
|
week, or an ISO Stage 2 audit. What Verae can do --- and what this
|
|
briefing is written to make precise --- is provide the **tools**, the
|
|
**background**, and the **software infrastructure** that make it easier
|
|
to implement the **technical portion** of those programs.
|
|
|
|
.. raw:: latex
|
|
|
|
\clearpage
|
|
\tableofcontents
|
|
\clearpage
|
|
|
|
.. toctree::
|
|
:maxdepth: 2
|
|
:numbered:
|
|
:caption: Contents
|
|
|
|
what-verae-provides
|
|
datacube-server
|
|
data-in-transit
|
|
data-at-rest
|
|
timestamped-receipts
|
|
peergos-eu-evaluations
|
|
global-timestamping
|
|
iceberg-archive
|
|
architecture
|
|
baa-dpa
|
|
checklist
|
|
howto
|
|
bio-james-garfinkel
|
|
bio-stuart-haber
|
|
bio-george-lambert
|
|
contact
|