WHAT'S INCLUDED

DRATA Compliance Accelerator Program Statement of Work
‍
Through a Drata trusted VCISO/MSSP partner, Drata offers a quickstart program to all their customers for implementing Information Security Programs that leverage Drata as the foundation and baseline for all infosec and compliance requirements.

• GAP ANALYSIS Partners will conduct a compliance gap analysis leveraging Drata integrations based on the selected compliance frameworks to identify gaps across the organization.
• Services included
• Scope and customize compliance framework requirements and assign control owners (if applicable)
• POLICY CREATION / REVIEW
• Services included
• Build information security policies based on Drata's policy categories (not just providing templates to be filled out).
  
• Leverage partner templates as a starting point, which have been designed and updated from the result of hundreds of successful audits.
  
• Establish all core policies that are categorically outlined in Drata.
• Review customer's existing policies (that are within Drata's policy categories) and call out gaps.
• Services NOT included
•  Build niche procedure documents.
• Combine partner-created policies with customer policies
• Guarantee every policy needed for every type of audit (auditors have different request lists, and some standards, like HIPAA and NIST, require careful curation of policies vs procedures).
• Handle more than one iteration of review changes from customer.
• Project manage to ensure every policy is approved and acknowledged by all customer personnel.
• Review customer's existing policies that are outside the scope of Drata's policy categories.
• SYSTEM DESCRIPTION DOCUMENTATION (*if pursuing SOC 2)
• For SOC 2 customers the Partners will guide the customer through creating this important document, ensuring it meets all standards.
• TABLETOP EXERCISE GUIDANCE AND RESTORATION TEST INSTRUCTION
• Partners will draft comprehensive security incident response and disaster recovery templates and provide instructions for customers to facilitate the successful completion of these mandatory tests.

This service is intended to ensure that you are achieving tremendous value from the Drata platform early on in your journey. While your implementation team can support your organization beyond the 30 day Compliance Accelerator service, this service does not include support on the following:

• Audit readiness for any compliance standard (i.e. SOC 2, ISO 27001, etc)
• Support on completing security assessment questionnaires (SAQ)
• Completion of a Disaster Recovery/Business Continuity Plan
• Representation as security or compliance team
• Security configuration changes for Cloud Infrastructure (AWS, GCP, Azure)
• Instant Messaging / Chat Support outside of Slack
• Building of custom frameworks or controls inside of Drata
• Migrations from another solution (this is handled by Drata's internal CS team)
• Editing current policies
• Employee onboarding / offboarding
• Completion of an Incident Response Plan or support in any actual security incidents

UPGRADE FOR ADDITIONAL SERVICES

This service is intended to ensure that you are achieving tremendous value from the Drata platform early on in your journey. While your implementation team can support your organization beyond the 30 day Compliance Accelerator service, this service does not include support on the following: