Aegis / Clearwater Medical - Comply v2 Deployment Kickoff

Alright, I think we've got everyone on now — Natalie, Ajay, good to see you both, welcome to the Comply v2 kickoff!

We totally hear you on that, and honestly that's exactly what Comply v2 was built for, so I think you're going to be really happy — let me also just quickly introduce Kevin and Mike who are joining me today.

So before we dive in, I just want to set the agenda real quick — we're going to walk through the Comply v2 feature set, talk about your specific compliance framework needs, get into the deployment plan, and then leave time at the end for questions and next steps, does that work for you both?

Great — so, big news, and I mean this is actually really good timing for you guys, Comply v2 went GA literally today, April 7th, so you are among the very first customers to be onboarding onto the new version.

Yeah it's genuinely exciting, and the headline feature that I know is going to matter a lot for Clearwater specifically is the on-demand reporting — so rather than waiting for scheduled report runs, your compliance team can pull a SOC 2 or HIPAA report literally whenever they need it.

Okay that — that right there is huge, because our last HIPAA audit we were scrambling to pull together evidence at like eleven at night, so on-demand is just... yeah, that's the thing.

+1Ajay calls on-demand reporting huge and contrasts it with a past late-night audit scramble. · compliance reporting

Yeah and the other thing I want to highlight is the multi-framework support, so Comply v2 covers SOC 2, PCI DSS, HIPAA, and ISO 27001 all in one place — Kevin, do you want to speak a bit to how that's structured under the hood?

Sure, yeah — so the way it works is that the platform uses a unified control mapping layer, which means a single data point or evidence artifact can satisfy requirements across multiple frameworks simultaneously, so if you're doing HIPAA and SOC 2, you're not duplicating work, the system handles the cross-mapping automatically.

That is — okay that is actually really smart because that was one of my biggest pain points, I was maintaining like three separate spreadsheets for three different frameworks and it was just, ugh, it was a mess.

+1Ajay says the unified control mapping is really smart and removes a big pain point. · compliance reporting

So Natalie, I know from our earlier conversations that HIPAA is obviously the primary framework given that you're in healthcare, but can you give us a sense of what else is on your radar — I believe PCI came up at some point?

Yeah, so HIPAA is definitely the big one, that's non-negotiable for us — but we also process some payment data through our patient portal so PCI DSS is relevant, and then our board has been nudging us toward ISO 27001 as more of a longer-term goal, maybe end of year.

That's actually a really common progression we see in healthcare organizations, and the good news is you can start with HIPAA and PCI in Comply v2 and then ISO 27001 just kind of layers on without a big lift — Mike, can you talk a little bit about the deployment sequence we'd recommend here?

Yeah absolutely — so for Clearwater, what I'd suggest is we start with the data connector setup first, getting your cloud environment piped into the platform, and then we layer in the HIPAA framework configuration, run a baseline report, and that gives you an immediate lay of the land before we touch anything else.

How long does that initial connector setup typically take, like are we talking hours or days?

For a cloud environment your size, honestly, the connector piece is usually a few hours if everything goes smoothly — I'd say plan for a full day just to give yourself buffer, and then the HIPAA baseline report can actually run that same day once data is flowing.

Oh that's faster than I expected, honestly I was bracing for like a week of setup.

+1Natalie says the setup time is faster than she expected. · onboarding and implementation

Yeah v2 specifically made a big push to reduce that time to first value — the old version had a lot more manual configuration steps and we heard that feedback pretty loudly from customers, so that was a big focus area.

Ajay, while we're on the topic, what does your typical audit cycle look like — like how far in advance do auditors usually come knocking?

So for HIPAA we get maybe, um, thirty days notice if we're lucky, sometimes it's less, and then SOC 2 we're actually pursuing type two for the first time this year so that's more of an ongoing thing over like a six month observation period.

Okay so the SOC 2 type two use case is actually perfect for Comply v2 because the continuous monitoring integration means evidence is being collected automatically throughout that observation window, so you're not trying to reconstruct what happened six months ago.

Yeah that's a really good point, I want to make sure we're not losing any time — Natalie, should we try to target getting the connectors up this week?

I think so, yeah — Mike, what do you need from us to get that started, like what does the prep checklist look like on our end?

We're primarily CloudPrime, we have a small Azure footprint but like eighty percent is CloudPrime.

Perfect, CloudPrime is very well-trodden ground for us — so you'll need to create an IAM role with read permissions that we can assume, I'll send you a CloudFormation template that does that in about five minutes, and then just make sure your CloudTrail logging is enabled across all regions.

CloudTrail should already be on, we turned that on a while back — I'll double check the multi-region piece but I'm pretty confident we're good there.

Great, that's going to make things really smooth — and once I send that template over, you or your team can run it in maybe ten minutes and then just send me the role ARN and we're off to the races.

So let's talk about next steps and timeline — what I'm thinking is Mike sends over that CloudFormation template today, we target connector setup early this week, baseline HIPAA report by maybe Wednesday or Thursday, and then we reconvene late this week to review the first report together — does that sound reasonable?

That sounds great to me — Ajay, does Thursday work for you for that review call?

Thursday works, yeah — and honestly I'm just really glad we're moving this fast, this has been a long time coming for our compliance program and I feel really good about where this is headed.

+1Ajay says he is really glad they are moving fast and feels good about where this is headed. · onboarding and implementation

That's exactly what we want to hear — alright, I'll get a Thursday invite out to everyone, and in the meantime don't hesitate to reach out if anything comes up, we are very much in this together.