Okta
LiveSingle sign-on, MFA enrolment, and access reviews pulled on schedule.
Platform / Evidence collection
Evidence that gathers itself, dated and sourced
Connect the systems you already run and evidence is collected on schedule, labelled with its source, collection time, and the controls it supports. Auditors get read-only access to the exact items they asked for.
The feature list below is the module definition the template ships with; counts and wording come straight from the module data file.
Scheduled collection from cloud, identity, and code systems
Every item carries source, timestamp, and control mapping
Auditor view scoped to the requested framework and period
Expiry alerts when an item goes stale before the audit window
Drawn from the integration directory by category (Identity, Cloud infrastructure, Development, Endpoint): 10 of 18 directory entries connect to this module.
Single sign-on, MFA enrolment, and access reviews pulled on schedule.
User inventory, conditional access policies, and privileged role changes.
Admin roles, two-step verification settings, and account recovery events.
Directory groups and privileged account membership from on-prem domains.
Configuration evidence for accounts, storage, logging, and network rules.
Subscription policies, resource configuration, and activity log exports.
Project IAM, audit logs, and firewall rule snapshots.
Branch protection, reviewer rules, and admin action history.
Protected branches, approval rules, and self-hosted runner configuration.
Device encryption state, OS versions, and compliance profiles.
Evidence collection supports two deployment modes. The platform page compares the modes across all five modules.
Runs in the hosted service. Collectors connect out to your systems over encrypted links, and the workspace region sets where the stored evidence lives.
Runs inside your own network boundary. Collectors and stored evidence stay on infrastructure you operate; auditor access is exposed through a scoped, read-only gateway.
The other modules read and write the same evidence record.
Policies with owners, versions, and review dates
Every vendor reviewed, every review on file
A public page that answers security questions once
Risks scored, treated, and reviewed on a cycle
A demo connects two or three of your source systems and shows the first readiness picture from your own data.