Heyo! My boss is convinced we need to create screenshot evidence of adding new staff to Google Calendar meetings, Google...

8 comments

· Sorted by Oldest

Linda B.
·
·
You only need evidence of an onboarding/offboarding checklist if access is standard for certain roles. You'll need tickets or documents which save the checklist with who said the work was done but you shouldn't need to add screenshots of access list from the tool itself except for access reviews. If your access reviews are producing lots of cleanup tickets then there is a broken access request and removal process. If you have critical vendors in Vanta as integrations, Vanta will tell you if a person leaves and they haven't been removed from an app.
💜1
Jake T.
·
(edited)·
Thanks! I'm working on an initial access matrix now, so everyone gets an email (will eventually be automated within our HRIS), all devs get GitHub access, etc... My goal is to get that matrix signed by leadership and point at it for access approvals for any new accounts. I'm hoping I can point at that matrix and the matching Vanta evidence and avoid the need for dedicated checklist?
Linda B.
·
·
Vanta can help with the off board but not the onboarding. Also, if you really want Vanta to be the "source of truth" for offboarding you will need to add custom activities like getting returned equipment and such. Most people track those things in a ticket system and create workflows. If you use slack, have you looked at AccessOwl?
Jake T.
·
·
I just wrote it down to look at tomorrow, thanks! I actually submitted a feature request a while ago to add arbitrary steps in the offboarding process like asset recovery or NDA reminders. Are you saying that's supported now?
Jake T.
·
·
Thanks for all your help!
Jeff W.
·
·
Jake, you might create a group for everyone in the OU and then add that group to the calendar invite. That would mean as you do your account setup and they are in your internal or whatever OU, they also get the meeting. One screenshot and you're done.
Jake T.
·
·
Good suggestion! I've actually tried that but we don't have the right Google Workspace license for dynamic groups. I've got some time blocked early next week to set the groups up regardless so that I can just do one screenshot of the groups association for the new user instead of multiple screenshots of invites. I'll just have to manually add every new member.
Linda B.
·
·
You can add manual items to the offboarding and require either a doc upload (screenshot or doc) or a e-signature that the step was completed. Nothing automated.
💜1

Linda B.
·
·
You only need evidence of an onboarding/offboarding checklist if access is standard for certain roles. You'll need tickets or documents which save the checklist with who said the work was done but you shouldn't need to add screenshots of access list from the tool itself except for access reviews. If your access reviews are producing lots of cleanup tickets then there is a broken access request and removal process. If you have critical vendors in Vanta as integrations, Vanta will tell you if a person leaves and they haven't been removed from an app.
💜1
Jake T.
·
(edited)·
Thanks! I'm working on an initial access matrix now, so everyone gets an email (will eventually be automated within our HRIS), all devs get GitHub access, etc... My goal is to get that matrix signed by leadership and point at it for access approvals for any new accounts. I'm hoping I can point at that matrix and the matching Vanta evidence and avoid the need for dedicated checklist?
Linda B.
·
·
Vanta can help with the off board but not the onboarding. Also, if you really want Vanta to be the "source of truth" for offboarding you will need to add custom activities like getting returned equipment and such. Most people track those things in a ticket system and create workflows. If you use slack, have you looked at AccessOwl?
Jake T.
·
·
I just wrote it down to look at tomorrow, thanks! I actually submitted a feature request a while ago to add arbitrary steps in the offboarding process like asset recovery or NDA reminders. Are you saying that's supported now?
Jake T.
·
·
Thanks for all your help!
Jeff W.
·
·
Jake, you might create a group for everyone in the OU and then add that group to the calendar invite. That would mean as you do your account setup and they are in your internal or whatever OU, they also get the meeting. One screenshot and you're done.
Jake T.
·
·
Good suggestion! I've actually tried that but we don't have the right Google Workspace license for dynamic groups. I've got some time blocked early next week to set the groups up regardless so that I can just do one screenshot of the groups association for the new user instead of multiple screenshots of invites. I'll just have to manually add every new member.
Linda B.
·
·
You can add manual items to the offboarding and require either a doc upload (screenshot or doc) or a e-signature that the step was completed. Nothing automated.
💜1