How MyOutDesk Turned Fragmented Security Controls into a Coherent Trust Program
Challenge
Strong technical controls across cloud infrastructure, CRM, and other systems, but no centralized way to connect them to policies or a formal GRC program.
Personnel compliance processes weren't yet centralized, leading to gaps in policy acknowledgement, breach-notification workflows, and ongoing assurance.
Security questionnaires forced Director of IT Jayson Lindsley and his team to re-document the same controls for each prospect, slowing sales and pulling a lean engineering team into compliance work.
Existing security tooling surfaced a noisy set of findings that were hard to scope and prioritize, making it difficult to focus on the controls that mattered most.
Solution
Implemented Drata as the unified platform for SOC 2, HIPAA, and ISO 27001 with current use cases in mind as well as readiness for future audits.
Connected core systems so Drata could continuously monitor technical controls and surface the most relevant compliance signals.
Centralized policies and mapped them to controls, using Drata to drive policy acknowledgements and personnel compliance from a single system.
Published their Drata Trust Center, giving prospects self-serve access to SOC 2 reports and security documentation and simplifying security assurance conversations.
Results
~3 FTE roles freed up that would otherwise be required to run security and compliance manually.
Avoided ~ $100K per year in device management and security operations spend by choosing the right tools and partners.
Cut security review calls from 10–12 over six months to zero in the quarter after launching the Drata Trust Center.
Background
MyOutDesk is a global outsourcing and offshoring partner that helps organizations extend their teams with highly skilled virtual professionals across operations, sales, marketing, customer service, and back-office functions. A small IT and engineering team supports this scale, handling infrastructure, application development, security, and vendor management.
As Director of IT, Jayson Lindsley (JL) owns “anything technical,” effectively operating as a CTO-level leader while managing 4 Developers and 5 IT related personnel.
Before Drata, MyOutDesk invested heavily in technical security using cloud-native controls, CRM security features, and other tools to detect data exfiltration and protect critical systems. But those safeguards lived in separate systems with documentation and policy mapping spread across tools rather than presented as a single, cohesive program.. Personnel compliance was not systematically managed, and Lindsley had to repeatedly explain the same safeguards in one-off security questionnaires.
At the same time, MyOutDesk was preparing for SOC 2, with a goal of making audits a non-event by maintaining around 98% readiness on an ongoing basis. HIPAA and ISO 27001 were on the roadmap, but the team needed a scalable way to turn ad hoc controls into a structured, measurable program without adding headcount.
“We had all these security mechanisms on the tech side that we’d set up because we knew they were important. It wasn’t documented, it wasn’t sitting anywhere, and we didn’t know how to bridge the gap between that and policy. ”
Turning Fragmented Controls Into a Coherent Security Program
With Drata, Lindsley and his team started by connecting their core infrastructure and SaaS systems, then layering SOC 2 controls and policies on top. As they mapped controls and uploaded evidence, they saw that much of what was required was already in place. The missing piece was structure. They were doing the right things, but needed a single pane view for their team’s alignment and documentation.
Drata’s frameworks and control mappings gave MyOutDesk a single place to see how technical safeguards roll up into SOC 2 and other frameworks. The team used Drata’s policy templates as a starting point, then tailored language to fit their operating model and breach-notification obligations. Policy acknowledgements and personnel compliance could now be tracked in one platform instead of across scattered systems.
For Lindsley, the platform also acted as a structured guide. It helped him translate years of engineering-driven security work into a repeatable, auditable program without becoming a full-time compliance officer.
“It almost felt like a tutor. The platform is built in the right way to facilitate understanding of all the stuff we were already doing, but in a more mature and structured way.”
Reducing Noise and Focusing on the Controls That Matter
Before Drata, Lindsley relied on multiple security tools to watch over MyOutDesk’s cloud posture. While powerful, they generated a broad set of findings that were difficult to scope and prioritize. New recommendations or checks could appear as alerts even when they were not materially relevant to MyOutDesk’s risk profile.
By shifting their day-to-day focus into Drata’s monitoring, Lindsley’s team can see signals from cloud, identity, and business systems in the context of specific framework controls. Instead of wading through pages of raw findings, they work from a curated list of issues tied directly to SOC 2 and other requirements.
The result is a move from reactive investigation to targeted action. Drata helps them shift from hour-plus review sessions in disparate tools to quickly seeing which controls matter, what evidence is missing, and where to focus engineering time.
“We don’t need to live in those separate cloud security tools anymore. For the controls we care about, we rely on Drata’s monitoring. It strips out the noise so we can focus on what actually matters.”
Freeing IT Capacity Across Devices, Vendors, and Access Reviews
As MyOutDesk went deeper into Drata, the impact extended beyond frameworks and monitoring into day-to-day operations.
First, expert guidance from Drata helped Lindsley choose an effective combination of device management and endpoint security tools, avoiding an expensive “hand it all to an MSP” approach. By pairing the right MDM platform with a security vendor and aligning that configuration with Drata’s expectations, MyOutDesk avoided an estimated six-figure annual spend that would otherwise have gone to outsourced management.
Second, Drata’s structure around policies, evidence, and control ownership functions like an additional specialist on the team, extending the reach of MyOutDesk's existing expertise without adding headcount. This enables Lindsley to own the program design while leaning on Drata’s expertise and partner network to refine policies and ensure they are implemented correctly.
Finally, consolidating vendor records, user access reviews, and evidence generation in Drata removes a substantial amount of manual work. Tasks like exporting user lists, reconciling licenses by department, and packaging screenshots for auditors are replaced with centralized monitoring and workflows, freeing the IT and CRM admin team to focus on higher-value projects.
“Realistically, without Drata we’d be looking at around three full-time roles to run this program the way we do now—one for the technical infrastructure, one for policies and program ownership, and another for vendor management and evidence. Instead, we can cover all of that with our existing team.”
What Drata Unlocked for the MyOutDesk GRC Team
For MyOutDesk, Drata turned a strong but fragmented security posture into an operationalized, measurable program that the whole business can understand.
Lindsley now uses Drata’s readiness metrics and control status as part of the company’s weekly leadership meetings, giving stakeholders a clear, consistent view of security posture. SOC 2 readiness is tracked against a high bar—around 98%—so that audits are routine checkpoints rather than all-hands events. HIPAA and ISO 27001 work can build on that foundation, reusing evidence and controls instead of starting from scratch.
Drata’s Trust Center capabilities also changed how MyOutDesk approaches customer and prospect conversations. Instead of fielding repeated questionnaires and ad hoc security calls, the team points prospects to a centralized Trust Center where they can review posture, request SOC 2 reports, and satisfy most due-diligence needs before a live conversation is even needed.
“Before, I was constantly on security calls, walking people through what we do. Now, most prospects check the Trust Center, request our SOC 2, and that’s it. The trust piece is already solved before we even get on the phone.”
Future Outlook
With SOC 2 Type 1 in place and an operational cadence established, MyOutDesk is focused on maintaining high readiness and expanding its program thoughtfully. HIPAA is the next major milestone, driven by their BAA obligations. ISO 27001 is also on the roadmap, and because many of the more demanding ISO 27001–aligned controls are already in place, Lindsley’s team can move quickly when it makes strategic sense.
Looking ahead, Lindsley’s goal is for security audits and customer reviews to remain non-events, routine validations of an already strong posture rather than crisis responses. Drata’s frameworks, monitoring, and Trust Center give his team the structure and visibility to sustain that assurance without adding headcount.
“Just having Drata as our audit platform changes the whole conversation. Prospects see the Trust Center, request our SOC 2, and the tension drops. It lets us focus on assurance and execution instead of constantly proving we take security seriously. ”
Latest Stories
Chart Your Course
Navigate to new worlds of trust with Drata.
Chart Your Course
Navigate to new worlds of trust with Drata.