Before
Compliance teams likely had to query device inventory, gather security and encryption details, build and format a spreadsheet, export the file, and upload it during each reporting cycle. They also had to assign the uploaded evidence to the appropriate controls manually.
How it works
- A scheduled run retrieves the relevant device inventory and creates a dated compliance report with standardized columns.
- The workflow processes each device and appends its user, encryption, security, and firewall details to the report.
- The completed report is exported, uploaded to the compliance platform, and assigned to the relevant controls.
Workflow details
- Scheduled collection: A scheduled trigger starts the workflow and retrieves paginated computer inventory records, including hardware, disk encryption, security, user, and location details.
- Report preparation: The workflow creates a dated spreadsheet, adds standardized headers for email, disk encryption, encryption percentage, Gatekeeper status, Secure Boot level, and firewall status, and prepares it for evidence collection.
- Device-level processing: Each inventory record is processed individually, with the relevant compliance details appended to the corresponding spreadsheet row.
- Evidence packaging: Once all device records have been added, the completed spreadsheet is exported into the required spreadsheet file format for submission.
- Compliance assignment: The exported report is uploaded to the compliance platform and assigned to the relevant controls, making the evidence available for the reporting cycle without manual intervention between runs.
What changed
Each scheduled reporting cycle now collects device evidence, builds the report, and completes the upload and control assignment automatically. Analysts no longer need to intervene between scheduled runs to assemble or route the evidence.
Work removed
Manually querying device inventory, collecting compliance fields for each device, creating and formatting spreadsheets, copying device details into rows, exporting reports, uploading evidence, and assigning reports to compliance controls.
Expected outcome
An estimated 15–30 minutes of recurring manual work is removed per reporting cycle, with consistent evidence coverage across the processed devices and control assignments.
