Exactly, as someone who recently helped finish a HITRUST (which focuses on HIPAA compliance) audit, the real work is in proving that the org has policies, proce

Exactly, as someone who recently helped finish a HITRUST (which focuses on HIPAA compliance) audit, the real work is in proving that the org has policies, procedures and actually follows them. Technical controls are the easy part. I've often dreamed of some type of way to streamline the policy --> process --> documentation pipeline.