Aegis / Forge Industries - PCI DSS Compliance Review

That's great to hear! And I also have Ananya Sharma on the line with me today — she's one of our senior engineers on the Comply side of things, she's going to be super helpful for the more technical questions you might have.

Ha, well we'll take that! So just to set the stage for today — we wanted to walk you through what's new in Aegis Comply v2, specifically around the PCI DSS reporting capabilities, and then really hear from you about where Forge Industries is in your compliance journey and see how we can help. Does that agenda work for you?

Yeah absolutely, that's exactly what I need. So, uh, a little context from my side — we've been going through our PCI DSS audit prep and honestly it has been a nightmare. Like, our current process is... it's very manual. Spreadsheets, a lot of back and forth with our QSA, it's just — it eats up weeks of engineering time.

-1Gerald describes PCI audit prep as a nightmare with manual spreadsheets. · compliance reporting

Exactly, exactly. And we've got, you know, we've got our OT systems, our ERP, we've got point-of-sale on the distribution side — so the scope is, it's not small.

-1Gerald highlights the large compliance scope across OT, ERP, and POS as a burden. · compliance reporting

Right, so that's actually a perfect segue for me to jump in on the product side if that's okay. So with Comply v2 — and this just went GA two days ago, April 7th — we've built out on-demand reporting that's fully mapped to PCI DSS controls. And what that means in practice is you're not waiting for a quarterly export or anything like that. You can pull a report at any point in time that shows your current control posture mapped directly to the PCI DSS requirements.

Okay. Okay that's — yeah, that's significant. Because right now we're like, we're going back and forth with our QSA and they'll ask for evidence on a specific control and it takes us sometimes two, three days just to pull it together.

-1Gerald says evidence requests take two to three days to pull together. · compliance reporting

That works for me. So, uh, what about multi-framework? Maria had mentioned something about that — we're also starting to look at SOC 2 this year so I'm curious if there's overlap.

Yeah, so this is one of the things I'm most excited about with v2. We support PCI DSS, SOC 2, HIPAA, and ISO 27001, and the way we've built it is — the underlying control evidence is mapped across frameworks. So if you have a control that satisfies a PCI DSS requirement and it also maps to a SOC 2 criteria, you're not collecting evidence twice. It's the same artifact, surfaced in both reports.

Gerald, I know you mentioned earlier in the year that you were worried about the SOC 2 prep running in parallel with the PCI audit cycle. This kind of addresses that directly, right?

It absolutely does. Yeah. I mean, honestly I was kind of dreading telling my team we had to spin up a whole separate program for SOC 2. This — this changes the math on that conversation significantly.

+1Gerald says the shared-control approach changes the math on the SOC 2 conversation. · compliance reporting

I'm really glad to hear that. Can I ask — on the PCI side specifically, where are you in your audit cycle right now? Like, are you in active audit, prep, or...?

We're in prep. Our QSA assessment is scheduled for, uh, end of June. So we've got about — what, two and a half months? Which sounds like a lot but it really isn't when you factor in all the evidence gathering and the remediation items we still have open.

Okay, that's actually a really workable timeline. Two and a half months is enough to get you meaningfully set up in Comply and have real, audit-ready reports by the time your QSA comes in.

And from an onboarding standpoint — like, what does that actually look like? How long does it take to get connected and start seeing real data?

So typically for an environment like yours — and I'm making some assumptions based on what Maria has shared with me, but assuming you're running in a hybrid cloud setup with some on-prem — we're usually looking at one to two weeks for the initial integration and data ingestion to be in a solid state. Then maybe another week to tune the control mappings to your specific environment. So call it two to three weeks before you're getting meaningful report output.

That's — yeah, that's faster than I thought honestly. I was assuming it would be like a two month implementation just based on past experiences with other tools.

+1Gerald says two to three week onboarding is faster than expected. · onboarding and implementation

Ha, that's refreshing. Okay so — and I don't want to get too far ahead of ourselves here but — are we talking about this as like a standalone Comply add-on, or is this tied to expanding the broader Aegis footprint with us? Because we're already using Protect and I've had some conversations internally about Detect.

It can be either, honestly. Comply v2 is available as a standalone module, but there are some really nice synergies if you're running it alongside Detect especially — because Detect feeds security event data into the compliance evidence chain automatically. So your threat monitoring logs become part of your audit trail without any extra work.

Okay I'm going to be honest with you both — that's kind of the pitch that makes Detect interesting to me again. We had some concerns earlier this year about reliability.

-1Gerald voices lingering reliability concerns about Detect despite renewed interest. · service reliability

Yeah, I — I was going to bring that up actually, I didn't want to gloss over it. The March outage was a real issue and I completely understand if that shook your confidence. We've made significant architectural changes since then — redundant processing nodes, circuit breaker patterns on the ingestion pipeline — and I'm happy to share the full post-incident review with you if that would be helpful.

Yeah, I'd actually appreciate that. My team flagged it and it came up in our last steering committee so I want to be able to address it with some substance, not just take it on faith that it's fixed.

+1Gerald appreciates the offer of the post-incident review to address steering committee concerns. · support experience

Totally fair. I'll get that over to you today. And look — I think it's actually a sign of where we want this relationship to go that you're asking the hard questions. That's exactly what I want.

So I'd love to set up a technical deep-dive with your team and Ananya — maybe a week from now — where we can actually walk through a demo environment and look at what PCI DSS reporting would look like for your specific setup. And in the meantime I'll send over the Detect post-incident review and a Comply v2 product brief. Does that sound right?

Yeah, that works. Can you also include something on the multi-framework overlap — like, even just a one-pager that shows the PCI to SOC 2 control mapping? That would be great for my internal conversations.

+1Gerald agrees to next steps and asks for a multi-framework one-pager, calling it great. · other

Absolutely, I can put that together. We actually have a pretty clean mapping document I can customize for you.

Perfect. Alright — I'm genuinely excited about this. Like, I came into this call a little skeptical just because we've had some bumps, but this is — yeah, this is looking really promising.

+2Gerald says he is genuinely excited and that the call is looking really promising. · other

That means a lot to hear, Gerald. We really do want to be a long-term partner for Forge, not just a vendor. Alright, we'll get everything over to you by end of day and we'll get that technical session on the calendar. Thanks so much for your time today.