Features Frameworks Guide Pricing

Integrations · Access & Privilege Management

Okta

ProofTrail connects to Okta through its API, as identity provider, access review, employee groups, vendor discovery. Each sync feeds the checks below, and a failing check opens a task for its owner.

Try the demo Every integration

Staff Data

Keep the staff list, managers, start and end dates in sync with the system of record. Synced every 24 hours.

  • Reporting manager should be assigned
  • Date of joining for new staff should be provided
  • Staff role should be assigned
  • Access should be removed for offboarded user

Access Control Data

Sync user accounts to ensure access is granted only to authorized personnel. Synced every 24 hours.

  • Rules for who can access critical systems should be configured
  • User access to critical system should be valid
  • User should be identified
  • User should have MFA enabled
  • MFA should be enforced on critical system
  • Periodic review of access to critical systems should be completed
  • Access should be removed for offboarded user
  • User should be identified (for access systems outside the audit scope)
  • User access to critical system should be valid (for access systems outside the audit scope)
  • User should have MFA enabled (for access systems outside the audit scope)
  • MFA should be enforced on critical system (for access systems outside the audit scope)
  • Access should be removed for offboarded user (for access systems outside the audit scope)

Employee Groups

Import groups so policies and trainings can target the right people. Synced every 12 hours.

  • Policy acknowledgment should be completed by onboarded staff

Vendor Discovery Data

Discover the third-party apps staff sign in to, so they can be reviewed as vendors. Synced every 24 hours.

  • Vendor risk should be scored
  • Vendor due diligence should be completed
  • Vendor risk assessment should be done periodically
  • Vendor risk assessment of each vendor register should be done every 12 months
  • Management review of each vendor register's risk assessment should be done every 12 months
  • Discovered vendors should be validated
  • Approved vendor requests should be mapped
  • Vendors processing personal data should have a data processing agreement