Compliance automation framework, focused on SOC2
Comply is a SOC2-focused compliance automation tool:
brew tap strongdm/comply; brew install comply
go get github.com/strongdm/comply
$ mkdir my-company $ cd my-company $ comply init
comply initis complete, just
git pushyour project to a new repository. You're ready to begin editing the included policy boilerplate text.
Join us in Comply Users
Comply relies on pandoc, which can be installed directly as an OS package or invoked via Docker.
NAME: comply - policy compliance toolkit
USAGE: comply [global options] command [command options] [arguments...]
COMMANDS: init initialize a new compliance repository (interactive) build, b generate a static website summarizing the compliance program procedure, proc create ticket by procedure ID scheduler create tickets based on procedure schedule serve live updating version of the build command sync sync ticket status to local cache todo list declared vs satisfied compliance controls help, h Shows a list of commands or help for one command
Comply is currently only released for Linux and macOS, however from other operating systems it's possible to run using Docker:
# first pull the latest published docker image $ docker pull strongdm/comply
from an empty directory that will contain your comply project
$ docker run --rm -v "$PWD":/source -p 4000:4000 -it strongdm/comply [email protected]:/source# comply init ✗ Organization Name:
serve content live from an established project
For Windows users, replace $PWD with the full path to your project directory
Ticketing integration with GitHub can be configured with the following YAML in
tickets: github: repo: github.com/your-org/SOC2 token: username: org-bot-user
GITHUB_USERNAMEcan be used to override values from the YAML file.
When comply creates a ticket (through
proc, for instance), it sets the following fields.
Please make sure that the default Create Screen has all of those fields enabled. Additionally, make sure that there are no other required fields for the issue type you choose.
About authentication, you need to create an API Token to use as a password.
Assumes installation of golang and configuration of GOPATH in .bash_profile, .zshrc, etc Inspiration: http://code.openark.org/blog/development/forking-golang-repositories-on-github-and-managing-the-import-path
$ go get github.com/strongdm/comply $ cd $GOPATH/src/github.com/strongdm/comply ; go get ./... $ make $ cd example $ mv comply.yml.example comply.yml $ ../comply -h $ ../comply sync $ ../comply serve # $ make # recompile as needed with in $GOPATH/src/github.com/strongdm/comply