Challenge
- Prepare for international market expansion, with prospective customers requiring an independently verified security posture before engagement.
- Build toward ISO 27001, SOC 2, and GDPR in under 12 months with a newly formed, lean security team.
- Manage overlapping requirements, evidence collection, policy development, and organization-wide adoption without first building a spreadsheet-based process.
Solution
- Built the compliance program in the Drata platform from the start, including control ownership, policy lifecycle, and evidence collection.
- Connected its cloud infrastructure to Drata, mapped controls across requirements, and used risk and vendor review workflows.
- Launched a Drata Trust Center, connected to the same compliance program.
Results
- Completed three independent audits in under 12 months covering ISO 27001, SOC 2, and GDPR.
- Expanded the Drata program to five frameworks and 321 controls under continuous monitoring.
- Reached an average Trust Center access-request turnaround of ~1 hour.
- Significantly reduced repetitive security questionnaire requests.
Background
Oz Forensics is a global leader in protecting people and organizations from biometric and identity fraud, with future-proof liveness detection that delivers maximum security, seamless user journeys, and flexible deployment at scale. Trusted by 70+ enterprise and government organizations in 30+ countries.
When international market expansion became a priority in 2024, the team formalized its compliance program around ISO 27001, SOC 2, and GDPR. The company already had security practices and some compliance elements in place. Its newly formed security team needed a scalable way to bring the program together and prepare for multiple independent reviews.
Artem Tulenov, CISO at Oz Forensics, chose Drata before the team wrote its first policy.
“We implemented Drata on day one, and it gave our security team the structure to build a multi-framework compliance program at a pace we couldn’t have managed manually. The platform keeps up as our requirements grow — that’s exactly what we needed.”
Building Audit Readiness Into the Foundation
Oz Forensics connected its cloud infrastructure, defined control ownership, and wrote its policy framework directly in Drata. Integrations pulled evidence from the environment, while cross-framework mapping reduced duplicate work across ISO 27001, SOC 2, and GDPR.
By the end of 2025, the team had achieved compliance with all three. Because the program was built in Drata from day one, the team did not first create a spreadsheet-based process that would later need to be migrated.
“That's the advantage of choosing your platform from the start: you don't accumulate technical debt in your compliance program.”
Extending Readiness Across Five Frameworks
Oz Forensics now manages five frameworks, certifications, and regulations in Drata: ISO 27001, SOC 2, GDPR, ISO 27701, and ISO 27017, with 321 controls under continuous monitoring. As the team added ISO 27701 and ISO 27017, it reused foundational controls from ISO 27001, identified the delta, and focused on what was net new.
Between reviews, real-time control visibility shows which controls are passing, which need attention, and when evidence is due for renewal. The team also runs its third-party risk program in Drata through the risk register, vendor inventory, and review workflows.
“How much visibility continuous monitoring gives you from day one. Once we connected our cloud infrastructure, Drata started providing a clear, real-time picture of our environment — where we stand, what can be tightened, where there's room to improve.”
Making Customer Assurance Self-Serve
Security reviews often started with questionnaires that could exceed 200 questions, followed by document requests and repeated follow-up cycles. Oz Forensics launched a Trust Center at trust.ozforensics.com to give prospects, customers, partners, and auditors a self-service starting point.
Connected to the compliance program in Drata, the Trust Center provides controlled access to security information and sensitive documents such as SOC 2 reports. Slack integration lets the team review requests from a phone, and the average turnaround time is about one hour.
The team reports a significant reduction in repetitive requests. Prospects can find relevant materials independently and arrive with more focused questions, shifting conversations toward integration. The Trust Center also supports ongoing communication through updates and subscriber notifications.
What Drata Unlocked
Drata gave Oz Forensics a foundation for continuous readiness rather than a one-time review process. The team moved from building its first formal compliance program to completing three independent audits within 12 months, then expanded from three initial frameworks to five without rebuilding the program from scratch.
For customers, the same foundation supports a more direct assurance experience. The Trust Center presents Oz Forensics’ security information through a controlled channel, while the underlying Drata program gives the team visibility into controls, evidence, vendors, and program expansion.
“Drata has helped our team turn compliance from no formal compliance program to a certified, continuously monitored, customer-facing one — in under twelve months.”
Future Outlook
Oz Forensics is completing certification work for ISO 27701 and ISO 27017. The team remains committed to continuously enhancing its compliance program by adopting additional frameworks and incorporating them into everyday business and operational processes. Oz Forensics plans to keep extending the program within the same platform. Cross-framework mapping and continuous visibility provide a way to address new requirements without starting over.
