With Sprinto, the commitment was very straightforward. It was clear to us what we’d be able to do and what we’d need to change at our end to achieve compliance. Sprinto’s team also helped us understand our current posture and what processes we’d need to achieve the standards as well as we wanted. This went a long way in cementing Sprinto as our first choice.

The Solution – Integrations-rich and automation-enabled compliance monitoring 

WebEngage decided to use Sprinto to achieve ISO 27701 certification first. Based on the results, they planned to pursue more frameworks (such as HIPAA and SOC 2), and even move ISO 27001 compliance management to Sprinto. 

To start off, Sanjay and the WebEngage team leveraged Sprinto’s pre-built policy templates to add documentation for ISO 27701. Existing ISO 27001 policies were also uploaded to the platform and mapped to built-in ISO controls. After this, the security team ran a policy acknowledgment campaign on Sprinto.

”Earlier, we had to get someone from HR to follow up and track policy acknowledgments. On Sprinto, you can tell how many employees have completed pending tasks and nudge them directly. The platform also sends the infosec team reminders for when to start new training and policy campaigns.”

Next, the WebEngage team used Sprinto’s in-built risk register to align risk practices with ISO 27001 standards. They mapped risks to relevant controls using both their existing controls library and Sprinto’s pre-built controls framework for ISO 27701. 

Having mapped to built-in tests that validate controls, WebEngage successfully automated management of 30 controls, while retaining semi-manual workflows for ~15 controls related to administrative and physical safeguards. 

“Most of the controls we used for ISO 27001 and 27701 overlapped with Sprinto’s, making it easier for us to make the switch to platform-led management. Earlier, we had to manage compliances in three different places, but it’s all consolidated within Sprinto.” 

Among the key processes that ISO 27701 requires to be streamlined and secured, in addition to overall risk management, are access and change management. For access management, Sprinto integrated with Google Workspace and GitLab to enforce role-based access to code repositories and support a zero-trust model. Roles added to Workspace were automatically synced with Sprinto, triggering controls whenever access to critical systems like GitLab deviated from the assigned role. 

Sprinto’s integrations with WebEngage’s incident and vulnerability management tools enabled the team to record, update, and manage incident status right on Sprinto, creating a clear audit trail of incidents. 

Change management was also streamlined on Sprinto, with Jira integration. This allowed Sanjay and the team to capture tickets and resolution statuses on the platform, unifying several aspects of compliance in one place. 

Throughout the process, Sprinto’s support team guided WebEngage in mapping controls to assets and processes according to key compliance requirements, ensuring automated validation while workflows ensured compliance.

As a result of compliance automation and expert guidance, WebEngage was ISO 27701-ready in just 6 months.

Sprinto was crucial in helping us identify gaps in our cloud setup and processes, which we were able to fill quickly with their guidance. The platform monitors our infra continuously and tells us what controls we need to check and fix, this has helped save a lot of time and effort for the security team.

The Results – Proactive posture and confidence in security 

Sprinto’s impact on compliance at WebEngage was felt at several levels. 

The primary impact was on WebEngage’s cybersecurity posture, which the team could make more proactive with Sprinto’s help. The platform keeps the team and stakeholders from management on top of compliance and notifies failing controls, incidents, and more in real time. This was instrumental in making compliance efforts visible and putting out fires at the first sign of smoke. As a result, WebEngage hasn’t experienced any significant CyberSec incident in the last 6 years. 

Additionally, Sprinto’s responsive integrations with cloud systems that make WebEngage’s operating environment helped intelligently identify and close control gaps. Coupled with automated nudges for at-risk controls, this helped WebEngage realize major savings in time and resources spent on managing compliance. 

“Today, if someone tells me to add a new framework, I know exactly what we’ll need to do and how long it will take. Earlier, these were things we had to figure out on our own, but Sprinto has made this so much easier.” 

So far, WebEngage has operationalized ISO 27001, ISO 27701, HIPAA, and SOC 2 on Sprinto, and are confidently taking on client questions about security posture while maintaining security at the highest standards.

We’re quite confident about our cloud security and compliance posture today, and this confidence translates to bigger clients and deals. Having multiple certifications under your belt helps push conversations forward, especially with MNCs and enterprise clients, and Sprinto has played a huge role in helping us achieve this confidence.