Rewind

Rewind fast-forwards SOC 2 compliance with automated evidence collection

Centralizing all SOC 2 tasks streamlined Rewind’s end-to-end process, tailored to their security needs

Moving away from spreadsheets
Efficiency in compliance across multiple teams
A custom, streamlined end-to-end process

Rewind protects SaaS businesses by backing up their data. They’ve backed up over 70 billion data points for top SaaS apps, including Shopify, BigCommerce, GitHub, Intuit QuickBooks Online, Trello, and others in over 100 countries.

While Rewind already has solid security, as proven by their impressive list of clients, the company wanted to achieve SOC 2 compliance and avoid endless spreadsheets and folders.

Moving away from spreadsheets toward a centralized security program

Lacking a formal security program, Rewind relied on spreadsheets and folders to track everything related to security.

For example, Rewind uses over 100 external applications and manually monitoring user application access became time-consuming.

"We needed a centralized way to manage our internal and external audits as well as governance, risk, and compliance tasks."

Megan Dean, the Information Security and Risk Compliance Manager

Efficiency in compliance across multiple teams and roles

The onboarding and offboarding modules were huge differentiators from the competition. Being a remote company and using about 100 external SaaS applications, Rewind has no physical infrastructure. Tracking access to these external apps is critical.

In addition, employees who have been through audit processes before noticed more efficiencies in their tasks since implementing the software. For example, control owners can manage their own responsibilities rather than spend time chasing individuals.

"It’s always a challenge when shifting processes and procedures to a new way of working. Having a tool that makes these processes easier for our control owners is a big deal."

Megan Dean, the Information Security and Risk Compliance Manager

A streamlined end-to-end process, customized for Rewind’s security needs

In October 2021, Rewind successfully completed the SOC 2 Type 1 audit; and in March 2022, they completed their SOC 2 Type 2.

Dean identified three ways a centralized security program helped achieve these results:

End-to-end audit preparation, automated evidence collection, and a formalized control review with auditors
Streamlined processes for user access requests, reviews, access modification, and de-provisioning
Policy authoring and approval and employee review tracking is now completely centralized and managed

Centralizing all SOC 2 tasks in one place has been an enormous success. Not only do the onboarding and offboarding modules used to track user app access make things more efficient, but automated evidence-gathering from external systems, like AWS (Amazon Web Services) and JAMF, has helped the team too.

"Leveling up our security game was most important to us," said Dave North, VP of Cloud Operations at Rewind. "As a data backup company, we have a lot of customer data we’re custodians for. We want to do everything we can to ensure this data is as secure as possible."

Megan Dean, the Information Security and Risk Compliance Manager

Rewind

Rewind fast-forwards SOC 2 compliance with automated evidence collection

Table of contents

Moving away from spreadsheets toward a centralized security program

"We needed a centralized way to manage our internal and external audits as well as governance, risk, and compliance tasks."

Efficiency in compliance across multiple teams and roles

"It’s always a challenge when shifting processes and procedures to a new way of working. Having a tool that makes these processes easier for our control owners is a big deal."

A streamlined end-to-end process, customized for Rewind’s security needs

"Leveling up our security game was most important to us," said Dave North, VP of Cloud Operations at Rewind. "As a data backup company, we have a lot of customer data we’re custodians for. We want to do everything we can to ensure this data is as secure as possible."

You may also like

Third-Party Risk

How OneTrust helps SMEs stay ahead of third-party risk

Join us for an engaging webinar designed specifically for dynamic small and mid-market businesses seeking to take advantage of their third-party management processes.

December 09, 2024

Third-Party Risk

Live Demo EMEA: Building a robust third-party risk management program with OneTrust

Join to explore how OneTrust's TPRM solution can revolutionize your third-party risk management approach. We will cover best practices for implementing and leveraging the software to minimize risks.

October 10, 2024

Third-Party Risk

APAC - Third-party risk management and due diligence: What’s the difference and why does it matter?​

Join this APAC webinar to learn the unique competencies of third-party risk and due diligence programs and examine when and how to align them to maximize the effectiveness of each.

September 18, 2024

Third-Party Risk

Third-Party operational risk: Shifting from reliance to resilience

Join this webinar to learn best practices for building a resilient third-party ecosystem and maintaining operational continuity in the face of unforeseen challenges.

August 15, 2024

Technology Risk & Compliance

Tech risk & compliance masterclass: The anatomy of a framework

Master the fundamentals of constructing robust compliance frameworks that can seamlessly integrate with organizational operations while aligning with regulatory and strategic mandates to deliver measurable insights on your progress and gaps.

August 14, 2024

Technology Risk & Compliance

Tech risk and compliance masterclass

Unlock tech risk management & compliance excellence. Master risk management, build robust frameworks, and foster cross-functional collaboration for long-term resilience.

August 07, 2024

Technology Risk & Compliance

Introducing OneTrust Compliance Automation

Join us as we explore OneTrust Compliance Automation, a holistic and fully integrated solution that streamlines and optimizes workflows, compliance, and attestation.

July 25, 2024

Trust Intelligence

TPRM Virtual Roundtable Series

Join the series of expert Roundtables on the topic of Third Party Risk Management

July 01, 2024

Third-Party Risk

TPRM privacy compliance: Questions to ask when working with third parties

Download this checklist to learn what questions to ask when designing a third-party risk management program that enables privacy compliance.

May 31, 2024

GRC & Security Assurance

Empowering your cyber defense: Key insights into the latest NIST CSF update with PwC

Join this webinar with OneTrust and PwC and gain insights into the upcoming NIST CSF update and learn how to effectively deploy it across your organization.

May 08, 2024

Third-Party Risk

Streamline compliance with the Digital Operational Resilience Act (DORA)

Download our infographic to learn about the new DORA regulation, who needs to comply, and how OneTrust can help streamline the process.

April 29, 2024

Third-Party Risk

5 Best practices for increasing resilience when working with third parties webinar

Learn how to leverage financial, operations, compliance, ESG, and cyber scores to drive resilience insights and detect possible supply chain disruptions.

April 18, 2024

GRC & Security Assurance

Certification Automation live product demo

Learn how OneTrust Certification Automation can help you scope, track, and manage security compliance holistically across complex operations.

April 10, 2024

Third-Party Risk

OneTrust third-party management demo video

Watch this demo video to learn how OneTrust third-party management helps organizations create resilient, secure, and scalable third-party ecosystems.

April 04, 2024

Third-Party Risk

6 steps to effective third-party risk management

See the path to managing third-party risk effectively with a checklist that outlines the six steps for a sound TPRM program.

March 29, 2024

Third-Party Risk

TPRM privacy compliance: 10 best practices when working with third parties

How can you build a privacy-focused TPRM program? In this webinar, we discuss best practices for privacy compliance when working with third parties, from onboarding to offboarding.

March 13, 2024

Technology Risk & Compliance

Rethinking risk assessments: Bridging the gap between best practices and action

Download our infographic to learn the main challenges faced during risk assessments, proven frameworks for assessing risks, and how to translate guidance into action.

March 07, 2024

Third-Party Risk

6 must-know trends in third-party management

APAC - Third-party risk management and due diligence: What’s the difference and why does it matter?