strongdm

Compliance automation framework, focused on SOC2

485 Stars 117 Forks Last release: about 1 month ago (v1.5.1) Apache License 2.0 188 Commits 69 Releases

Available items

No Items, yet!

The developer of this repository has not created any items for sale yet. Need a bug fixed? Help with integration? A different license? Create a request here:

Readme

Comply is a SOC2-focused compliance automation tool:

Policy Generator: markdown-powered document pipeline for publishing auditor-friendly policy documents
Ticketing Integration: automate compliance throughout the year via your existing ticketing system
SOC2 Templates: open source policy and procedure templates suitable for satisfying a SOC2 audit

Installation

Name: comply
Brand: comply
SKU: //strongdm/comply
Rating: 2.9625 (485 reviews)

macOS:

brew tap strongdm/comply; brew install comply

Linux:

Download latest release

Go users:

go get github.com/strongdm/comply

Get Started

Start with

comply init

$ mkdir my-company
$ cd my-company
$ comply init

Once

comply init

is complete, just

git init

and

git push

your project to a new repository. You're ready to begin editing the included policy boilerplate text.

Discussion

Join us in Comply Users

Screenshots

Demo video

Start a Project

screencast 1

Build PDFs

screencast 4 pdf example

Track Policy Coverage

screencast 3

Dashboard

screencast 2

Dependencies

Comply relies on pandoc, which can be installed directly as an OS package or invoked via Docker.

CLI

NAME:
   comply - policy compliance toolkit

USAGE:
   comply [global options] command [command options] [arguments...]
COMMANDS:
     init             initialize a new compliance repository (interactive)
     build, b         generate a static website summarizing the compliance program
     procedure, proc  create ticket by procedure ID
     scheduler        create tickets based on procedure schedule
     serve            live updating version of the build command
     sync             sync ticket status to local cache
     todo             list declared vs satisfied compliance controls
     help, h          Shows a list of commands or help for one command

Running in Docker

Comply is currently only released for Linux and macOS, however from other operating systems it's possible to run using Docker:

# first pull the latest published docker image $ docker pull strongdm/comply

from an empty directory that will contain your comply project

$ docker run --rm -v "$PWD":/source -p 4000:4000 -it strongdm/comply [email protected]:/source# comply init ✗ Organization Name:

serve content live from an established project

$ docker run --rm -v "$PWD":/source -p 4000:4000 -it strongdm/comply [email protected]:/source# comply serve Serving content of output/ at http://127.0.0.1:4000 (ctrl-c to quit)

For Windows users, replace $PWD with the full path to your project directory

Ticketing Integrations:

Jira
Github
Gitlab

Configuring Jira

When comply creates a ticket (through

proc

, for instance), it sets the following fields.

assignee
description
issuetype
labels
project key
reporter
summary

Please make sure that the default Create Screen has all of those fields enabled. Additionally, make sure that there are no other required fields for the issue type you choose.

Forking and local development

Assumes installation of golang and configuration of GOPATH in .bash_profile, .zshrc, etc Inspiration: http://code.openark.org/blog/development/forking-golang-repositories-on-github-and-managing-the-import-path

$ go get github.com/strongdm/comply
$ cd $GOPATH/src/github.com/strongdm/comply ; go get ./...
$ make
$ cd example
$ mv comply.yml.example comply.yml
$ ../comply -h
$ ../comply sync
$ ../comply serve
#
$ make # recompile as needed with in $GOPATH/src/github.com/strongdm/comply

comply

by strongdm