Aegis / Redwood Clinical - ISO 27001 Preparation

Good, good — yeah sorry it took us a bit to get this on the calendar, things have been moving fast on our end with the Comply v2 launch and everything.

Likewise, yeah, and honestly the timing could not be better because our CISO has been breathing down my neck about ISO 27001 since like January, so — any help getting a clearer picture of where we stand is going to be huge.

+1Says timing could not be better and any help would be huge. · support experience

Yeah, absolutely, and I think that's exactly where Comply v2 is going to change the game for you — um, before we dive in though, Thomas, can you just give Kevin a quick sense of where you are in the ISO journey? Like, have you done a formal gap assessment yet or are you still kind of in the early stages?

Yeah so we're — we're pretty early if I'm being honest. We had an external consultant come in back in February, they did a high-level gap assessment, and the short version is we have a lot of work to do on the information security management side, particularly around evidence collection and demonstrating continuous monitoring, which as a healthcare organization is like, that's a big deal for us.

Right, and that's such a common pain point, especially in healthcare — the auditors want to see a continuous thread of evidence, not just a snapshot, and that's historically been really painful to pull together manually.

Oh god, yeah, the last time we went through a HIPAA audit my team spent like three weeks just pulling logs and documentation together — it was a nightmare.

-1Describes prior HIPAA audit as a nightmare. · compliance reporting

Three weeks, yeah — that's — I mean that's not unusual but it's also exactly the kind of thing we built Comply v2 to eliminate, so let's talk about what that actually looks like in practice.

So — okay so the big thing with v2, and this just went GA on April 7th so it's very fresh, is the on-demand reporting engine. You can now generate a full ISO 27001 readiness report at any point, and it maps your current control posture directly to the Annex A controls — so you're not having to manually cross-reference anything, the platform does that work for you.

Wait, so it's actually mapping to the specific Annex A controls? Like, is that — is it just a template thing or is it actually pulling live data from our environment?

Live data — so it's pulling from your Detect telemetry, your Identity configurations, your Protect backup logs, and then surfacing all of that against the control framework. So when an auditor asks you to demonstrate, say, A.12.4 on event logging and monitoring, you can literally generate that section of the report on the spot.

Okay that is — yeah that is genuinely impressive, I wasn't expecting that level of granularity.

+1Calls live Annex A mapping genuinely impressive and more granular than expected. · compliance reporting

And it's not just ISO either — you mentioned HIPAA a second ago — the same report engine covers HIPAA, SOC 2, and PCI DSS as well, so if you ever need to spin up a HIPAA evidence package, it's the same workflow, same interface.

Yeah that multi-framework piece is something we specifically asked for in our renewal discussions, so it's great to see that actually shipped — Daniel you might remember that conversation.

+1Notes multi-framework support was requested in renewal and is glad it shipped. · product capability

So Thomas, one thing I want to make sure we cover — in terms of your timeline, do you have a target date for the ISO 27001 certification audit? Because that's going to shape how we structure the onboarding to Comply v2.

Our CISO is targeting Q1 2027 for the formal audit, so we have — you know, roughly eight or nine months, which sounds like a lot but when you factor in the remediation work it's going to go fast.

Eight months is actually a really solid runway for this — um, what I'd typically recommend for organizations at your stage is we start with a baseline report run in the first two weeks, just to get a concrete picture of where you are against the framework, and then we build a remediation roadmap from those gaps.

Both, honestly — the report is designed to be readable by a non-specialist, we have like a traffic light system for control status, but Kevin and I will absolutely walk through it with you line by line on a follow-up call.

Yeah I was going to say — I'd actually love to do a working session with you and maybe whoever on your team is going to be the compliance lead, we can go through the report together and I can explain what each gap actually means in practical terms, not just the framework language.

That would be — yeah that would be incredibly helpful, I have a security analyst, her name is Priya, she's been leading the internal ISO prep work and she would get a lot out of that kind of session.

+1Calls the proposed working session incredibly helpful. · support experience

Perfect, let's make sure Priya is on the next call — I'll send a calendar invite for a technical working session, maybe two weeks out, that gives you time to get Comply v2 activated and run that first report.

It's pretty lightweight on your end — since you're already running Detect and Identity, the data connectors are mostly already in place, we just need to enable the Comply v2 module on your tenant and do a quick configuration review to make sure all your data sources are mapped correctly, should take maybe an hour of your team's time.

Oh wow, okay, yeah that's much less overhead than I was anticipating — I was kind of bracing myself for like a big implementation project.

+1Expresses relief that activation overhead is much lower than expected. · onboarding and implementation

That means a lot to hear, Thomas — and we want to make sure it keeps playing out that way through the audit, so Kevin's going to be your dedicated point of contact for all things Comply through this ISO process.

Yeah, consider me on speed dial — seriously, if you or Priya hit questions on the platform or you're not sure how to interpret something in the report, just reach out, that's what I'm here for.

Really appreciate that — okay so just to make sure I've got the next steps straight: Kevin sends a calendar invite for the technical working session in two weeks, Daniel gets Comply v2 activated on our tenant, and in the meantime we — or I guess Kevin's team handles the module enablement, and then we run the first baseline report before that working session.

That's exactly it — I'll also send you a short prep document that explains what to expect from the baseline report so you and Priya aren't going in cold.

Perfect — honestly this call was really reassuring, I feel like we actually have a path forward now, which is not how I felt last week.

+1Says the call was reassuring and there is a path forward now. · support experience