← Back
Home › Systems › Finance, HR and back office

compliance-automation

SOC 2 / ISO 27001 evidence collection and controls

Vanta, Drata

SystemTechniques · 30Primitives · 90 compliance-automation Infrastructure as codecloud · medium: Declare servers, networks, DNS and permissions in versioned files and let a tool converge reality to them; Terraform/OpenTofu for most teams, Pulumi or CDK when you want a real language.›Desired-state reconciliationdistributed · medium: Declare the target in a store; controllers repeatedly diff actual against desired from full state and apply idempotent fixes, so missed events only delay convergence.›Deterministic simulation testingdistributed · medium: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.›Durable job queuedistributed · medium: Persisted tasks that workers lease for a visibility timeout, ack on success and retry with backoff; at-least-once execution that survives worker and queue crashes.›Incremental sync cursorsdistributed · medium: The client keeps one opaque token; each pull returns only the changes after it plus the next token, so sync cost scales with what changed, not with the dataset.›Primary-backup replicationdistributed · medium: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.›Coverage-guided fuzzingsecurity · medium: Mutate inputs, run an instrumented target, and keep any input that reaches a new code edge; feedback turns blind guessing into incremental search.›Exponential backoff with jittersystems · low: Retry after delays that grow geometrically and are randomized, so failed clients spread out instead of hammering a recovering service in synchronized waves.›Trusted timestampingsecurity · low: RFC 3161 time-stamp tokens: a TSA signs a hash with time, proving data existed thenSoftware bill of materialssecurity · low: SBOM generation (SPDX/CycloneDX) and component matchingObject storagecloud · low: S3-compatible blob storage at cents per GB-month with 11 nines durability; pick by egress price, request price and latency, not by storage price alone.›Hdr histogramdata-structures · low: Log-linear bucketed histograms with bounded relative error for latency percentilesProcess supervisionhardware-os · low: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.›Ldap directorysecurity · low: LDAP directory model, bind, search filters and group membership queries for enterprise identityMutual TLSsecurity · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.›OAuth 2 and OpenID Connectsecurity · low: Delegated authorization (OAuth 2) and login on top of it (OIDC); use authorization code + PKCE for every user-facing client.›Secret scanningsecurity · low: Detect committed credentials with provider-specific patterns, entropy checks and live verification, then revokeCron schedulingsystems · low: Cron expression parsing and next-fire-time computation, with catch-up and time-zone rulesGraceful drainingsystems · low: On a termination signal, stop taking new work, finish in-flight work until a deadline, tell clients to reconnect elsewhere, then exit; clients resume from a token.›Topological sortgraphs · low: Order the vertices of a DAG so every edge points forward; the core of build systems, schedulers and dependency resolution, with cycle detection for free.›Advisory file lockinghardware-os · low: Fcntl/flock byte-range and whole-file locks for multi-process access to one fileJSON Schema validationsecurity · low: Compile a JSON Schema once, then check every untrusted document against it, within hard size and depth limits, and report failures as JSON Pointers.›Secrets managementsecurity · low: Keep keys and passwords out of code and logs, give workloads short-lived identity instead of static keys, and make rotation routine.›+ 23 more techniques+ 74 more primitives

Similar systems

Share the most building blocks with this one.

uem 41 %iga 40 %document-management 33 %cnapp 33 %physical-access-control 33 %