Google Workspace, OneLogin, and evidence that bundles

Two more identity sources collect evidence on their own, evidence files combine without losing the originals, and the app gained a What's new panel.

integrationsEvidenceCompliance

Connecting an identity provider used to light up a card and little else. Google Workspace and OneLogin now read what compliance actually asks about: who has an account, who has a second factor, who holds an admin role, and in Google's case which laptops and phones they sign in from. The answers land in the identity register, the asset register and the controls that ask for them, so a control can pass on a connection you made once.

Integrations
  • Google Workspace is a connected source. It reads your users, who is enrolled in 2-step verification, who holds an admin role, and the ChromeOS and mobile devices on the account. Those answers feed the identity register, the asset register and the controls that ask for them, with nothing to upload.
  • OneLogin is a connected source. It reads your users, the MFA factors they have enrolled, and who administers a role, and feeds the same registers.
Compliance and evidence
  • Bundle evidence files into one new item. Pick files already in the library, combine them into a new evidence item, and every original stays exactly as it was. The bundle runs its validations across all of its files at once.
  • Evidence can be edited and keeps its earlier versions, and two files with the same name no longer collide.
  • Turn a check off on a control. A validation that does not apply can be disabled on a common control, which takes it off every framework control that borrows it, or on one framework control on its own. It leaves that control's list, its score and its required gate together.
  • A published policy answers its own evidence checks. Evidence type, management approval, owner, acknowledgement rate and distribution are read from the policy record, so those checks pass with nothing to upload, and the score moves when you publish, acknowledge or change the owner. Checks that need a reading of the wording stay open under "Needs other evidence".
  • An asset kind's fields are a searchable, filterable table.
Vendors
  • Set a vendor's criticality from its card, without opening it.
  • A "Created at" column on the vendors table, off until you turn it on.
Across the app
  • What's new. Every production release now gets an entry like this one, on the site and in the app's help menu.
Fixes
  • Muting a notification type mutes it everywhere. Rows already in the inbox stayed there and kept counting toward the unread badge, and the policy approval, policy review due and access review emails went out whatever the setting said.
  • Connecting AWS builds a role with the access it needs. The CLI and CloudFormation routes were handed a ViewOnlyAccess policy that cannot be attached, so the role came out half privileged and reads failed later.