Solution

Once the instance was set up and integrated with cloud applications, Mesmerise began by activating SOC 2, ISO 27001, HIPAA, and GDPR standards inside Sprinto. “We were immediately flooded with alerts. Sprinto was quick to identify configuration gaps in our code repos and infra setup, and our infra team immediately started resolving these,” notes Adéle.

Sprinto’s common control mapping played a crucial role in unifying all standards for efficient tracking and evidence collection. This harmonization of controls across standards, coupled with automated control testing, eliminated the need for manual tracking of systems and logs. “Sprinto provides a clear overview of how everything connects, and then it monitors everything for us. If I had to do this manually, I would need to refer to my control map spreadsheet to identify which controls are common or unique to a framework. Sprinto provided this mapping right out of the box. Besides saving time, this has led to a better understanding of control overall,” Adéle says.

On the non-technical side, Adéle uploaded their policy and procedure documents to Sprinto. This was followed by security training. “The training with Sprinto was excellent. It was user-friendly, avoided technical jargon, and included practical examples and tests. It was a significant improvement over the overly complex training in my previous role and saved me from creating training from scratch.”

Sprinto’s vendor management module enabled Adéle to consolidate vendors and build a single, reliable inventory. “Sprinto selected vendors from our workspace provider, eliminating the need for manual additions. We also included our non-SaaS suppliers to Sprinto to build a one-stop vendor inventory,” she says.

Managing vendors has become much easier with Sprinto. No one enjoys supplier management as it’s often one of the most tedious tasks in any company. Now, it only takes half an hour a month to go through it all. It’s something I can do on the go because it’s no longer overwhelming.

The effort required to accommodate both HIPAA and GDPR requirements was minimal. “As a data protection officer, I incorporated privacy essentials into our practice before we even began. We only had to update our privacy policy, and the control information from Sprinto was helpful,” Adéle notes.

It took Mesmerise 4 weeks to get fully set up. During this process, the group decided to split into three entities. Each entity pursued certification in all four frameworks. And each of the three entities collectively secured 12 certificates in another 4 weeks!

Results

Mesmerise achieved compliance with all 4 frameworks, completed audits, and received their audit report and certifications in approximately 60 days. “Sprinto put us in touch with a US-based auditor would could audit us for all frameworks at once. And we used Sprinto to show evidence against all four.”

Our infrastructure specialist and I trust the data accuracy of Sprinto — it gives no false positives or negatives. We verified the data from Sprinto and confirmed that the issues it reports are real and demand our attention. Essentially, Sprinto encourages further investigation, which is useful. We’ve adjusted the alert threshold on the platform to make sure we are focusing on the right issues at any given point.

Adéle recalls having no more than two email interactions with their auditor. “Sprinto had us covered. We only needed to connect with our auditors for a few additional pieces of evidence. If I were doing this the traditional way, I’d have to meet with my auditor in person and review each piece of evidence over several days.”

Since receiving certifications, Mesmerize Group has unlocked large deals in the North American market. With Sprinto running in the background, there is increased assurance of security best practices across Mesmerise. “Sometimes, clients need detailed information about our controls, but their terminology often differs from ours. We lean on Sprinto to identify the correct controls, show how it’s mapped, and how it is monitored. Having such visibility provides a lot of assurance.”

Sprinto’s intuitive mapping of controls across frameworks provides Mesmerise Group with insights into its readiness for other standards. Adéle notes, “It gives me easy access to relevant information, helping me make a case for a certain framework. Essentially, Sprinto helps us strategize and present the right information to the board about our control status and readiness. This supports market readiness evaluations.”

In effect, Sprinto has now eliminated more than 90% of compliance efforts. “Weirdly, I have so little to do,” exclaims Adéle. “Without Sprinto, most of my time would be spent mapping and coordinating evidence. Now I have more time to operate strategically, participate in events, and keep up with the threat landscape.”