StrongDM

Connection methods

• PAM vault API (read-only)
• Session recording metadata export
• SIEM forwarding of privileged sessions
• CSV access certification reports

Documentation topics

Review the following areas in StrongDM admin and product documentation before connecting to ComplAI:

• Admin console setup and service account creation
• API authentication, scopes, and rate limits
• Audit log export and retention settings
• Security hardening and least-privilege configuration

ComplAI integration overview

StrongDM integrates with ComplAI to support Propel Ready Solutions's GRC program. Infrastructure access proxy with session audit for databases, servers, and Kubernetes. This guide covers product context, the recommended connection process, prerequisites, and verification steps for audit-ready evidence collection.

Last updated: 2026-06-24

GRC evidence available

• Privileged account inventory
• Session recording coverage
• JIT activation audit logs
• Vault credential rotation status
• Just-in-time access metrics and configuration evidence
• Session logs metrics and configuration evidence

Prerequisites

• Named integration owner and backup contact at Propel Ready Solutions
• Change request approved per Propel Ready Solutions change management policy
• Network egress allowlisting completed if required by vendor
• ComplAI organization administrator access
• Admin or integration-builder role in StrongDM
• StrongDM product documentation reviewed (see Documentation topics below)

Integration process

1. Step 1

   Plan StrongDM integration scope

   Confirm which Just-in-time access and Session logs capabilities will be connected first. Start with read-only ingestion before enabling write actions.

2. Step 2

   Inventory privileged accounts and vaults

   Document all privileged systems, break-glass accounts, and vault coverage scope in ComplAI.

3. Step 3

   Configure PAM platform API access

   Create read-only API credentials for session metadata, vault inventory, and activation audit logs.

4. Step 4

   Enable session recording and JIT policies

   Verify session monitoring, approval workflows, and time-bound elevation are enforced for admin access.

5. Step 5

   Map to access review cycles

   Include privileged access recertification in quarterly entitlement reviews and leadership reporting.

6. Step 6

   Mark integration complete in ComplAI

   Update integration status to Connected, attach configuration evidence, and link mapped controls in the Controls library.

GRC benefits

• Privileged access evidence for ISO A.8.2 and SOC 2 CC6.1–CC6.3
• Session audit trails for incident investigation and regulator requests
• JIT elevation metrics for least-privilege enforcement programs

Related controls

Verification checklist

• ☐Integration credentials stored securely and rotation scheduled
• ☐Test sync completed successfully with sample records
• ☐Error alerting configured for failed sync or API rate limits
• ☐Control mappings documented in ComplAI
• ☐Evidence sample exported and reviewed by control owner
• ☐Runbook link attached to related controls

Troubleshooting