Read summarized version with
About project
Working time:
Since 2025
Industry:
Advertising technology
The service:
Managed Services
Overview
The customer is a Paris-based ad-tech company whose revenue analytics platform is used by publishers in Europe and North America. Dedicatted runs its AWS operations under a managed service, and its enterprise customers ask for SOC 2 assurance.
The Challenge
The company passed its controls review, then watched its configuration drift away from it until the next audit.
1. Drift Between Audits
Buckets lost default encryption, security groups were opened for tests, and new accounts started without logging.
2. Evidence by Hand
Screenshots and exports were collected manually in the weeks before each audit.
3. Findings Without Owners
Failed controls sat in a spreadsheet with no owner or due date.
4. Repeat Findings
The same issues came back in successive audits.
Technology & Approach
We added continuous compliance to the managed operations we already run, so controls are checked every day and evidence is collected every month.
Implementation
Control Mapping
Mapped the SOC 2 aligned controls to AWS Config rules and conformance packs across all accounts with an aggregator, and agreed which findings are fixed automatically and which need a person.
Automated Fixes
Safe remediations, such as re-enabling encryption or logging, run through AWS Systems Manager Automation with a record of each change.
Weekly Drift Review
Engineers review drift weekly, open tickets with owners and track exceptions with expiry dates.
Monthly Evidence
Monthly evidence reports and AWS Audit Manager assessments keep auditor-ready evidence current.
Customization & Client Adaptation
Compliance was built into day-to-day operations instead of run as a yearly project.
Part of Operations
Compliance checks run inside the same managed service that handles incidents and changes, so fixes do not wait for another team.
Safe Automation Only
Only fixes agreed in advance run automatically, and everything else goes to an owner.
Exceptions That Expire
Every accepted exception has an owner and an expiry date, reviewed monthly.
European Data Handling
Evidence and logs stay in the company’s AWS accounts in the EU Regions it uses.
If you find this case interesting, we recommend taking a closer look at
The Results
Configuration drift is now found within days and assigned to an owner, and the latest audit started with evidence already collected instead of weeks of preparation.
Long-Term Value
- Controls checked continuously, not once a year.
- An evidence trail that grows every month.
- Exceptions with owners and expiry dates.
Business Impact
- Faster answers to enterprise security questionnaires.
- Less engineering time spent preparing for audits.
- Fewer repeat findings.
