SOPIQ Compass · Compliance

Compass.
Evidence from the tenant,
not from a questionnaire.

The compliance platform that reads the tenant, the cloud accounts and the machines, scores every requirement with evidence, fixes what an API can fix, and hands the assessor the pack.

Start with SOPIQ Compass $249 per company, plus $2 per person on the roster
SOPIQ® registered trademark
Every module full featured
30 day trial on each module
Microsoft 365, GCC High and Google
Powered by SOPIQ
What is in it

Every feature,
no light version.

Reads Microsoft 365, Google Workspace, Exchange, Azure, AWS and Google Cloud and the customer's own machines; scores every control; fixes what it can through approved plays; writes the policies; builds the evidence pack; trains the people.

What it reads

  • Microsoft 365 commercial and GCC High: users, MFA and authentication methods, conditional access, Intune devices and compliance, Defender, audit log, SharePoint settings, licences
  • Exchange Online through the admin API: mailbox auditing, forwarding, DKIM, anti-phish, basic authentication, attachment filters
  • Google Workspace: users and 2-step, admin roles, devices, drive sharing, the alert center, licences
  • Azure subscriptions, AWS accounts (read-only keys, GovCloud too) and Google Cloud projects: storage open to the public, management ports, encryption, audit logging, threat detection
  • The collector: one scheduled task and one script on Windows, macOS and Linux machines, no service, no port; drive encryption, screen lock, local administrators, updates, antivirus, firewall, USB, audit policy, SMB, LAPS, remote desktop, the directory from a domain controller, shares, a sensitive-data scan you switch on
  • Network discovery from one machine per site: what answers on the wire, matched to the inventory, the rest marked as known or found
  • Deployment through the domain controller as a probe, through Intune, through your RMM, or by hand; the collector updates itself

How it scores

  • Every requirement of NIST SP 800-171 (CMMC Level 2, 110 controls), CMMC Level 1, HIPAA, NIST CSF 2.0, a SOC 2 starter, and frameworks of your own (cyber insurance, DFARS flow-down, anything you type in)
  • Checks on the reads become met, partial, not met or unknown, with the failing users, devices or settings named and the fix in the provider's own words
  • The SPRS score, projected and on the evidence; findings and the plan of action with owners and dates; drift tickets to the desk
  • Inherited and shared responsibility, exceptions and compensating controls, scope per environment (an enclave and a commercial tenant assessed apart)
  • The assessment workbook: every objective answered with evidence attached, notes shared with the customer or kept internal, staff answering on the customer's behalf with how recorded

What it fixes

  • Plays: check, fix, evidence. A library of plays for Microsoft 365, Exchange and Google that apply the setting through the tenant connection as a change ticket the customer approves, re-read the check and leave the evidence
  • Never by itself on an enclave; a cleared technician runs it; rollback and cancel

The program

  • A calendar of activities per tenant (access reviews, training, tabletop, vendor review, phishing quarter) with review records the reviewer signs and removals that become desk tickets
  • Questions and the rapid baseline with contradictions found, impersonation targets and risky users, the risk register, sites, CMMC categories on assets
  • Documents: the policy set, plans and procedures written from the records with the customer's parameters, versions with a diff, approval on the portal, the System Security Plan
  • Vendors with the questionnaire, training modules with narration, the phishing simulator sending through the customer's own tenant, policy acceptance by every person on the roster

For the assessor and the customer

  • Packs per customer, period and framework: hashed PDFs with a manifest, never regenerated in place; the SPRS worksheet; the HIPAA risk analysis
  • An auditor seat on the portal with expiry and scoped packs, every view logged
  • Questionnaires answered from the records with citations, the trust page with a band not a number
  • The customer portal: standing, what they must do, their documents, their questions, their training; invitations with Sign in with Microsoft or Google
$249 per company, plus $2 per person on the roster, annual commitment billed monthly; month to month available; two months free paid up front. Sold on its own or added to an Asteroniq account; every user of the company included. The first thirty days of the module are free.
Works with

The rest of the platform
is one click away.

Project management

SOPIQ Chart

Plans, people and time, with the project page the customer sees.

Explore SOPIQ Chart →

Start with SOPIQ Compass.
Thirty days, no charge.

Tell us who you are and we set the account up within one business day.

Start with SOPIQ Compass See the pricing