Tools for Compliance

Question

I am aiming at eventual HIPAA and SOC 2 compliance.  Right now from a tools perspective I have only Nessus, a scanning tool.  As far as tools that I may need to invest in, what are the areas and best tools in those areas that I need to look at, to have a shot at HIPAA + SOC 2.
Has anyone tried to quantify the areas that you need purchase tooling and/or develop automated reporting around in order to faciliate the process of driving toward compliance standards such as these and can help me quantify what is needed as represented below?
Area
Tool Example
What is the level Importance/Non-Importance for Compliance (Recommended, Important, Essential, or Overkill?)
Scanning of ESXi hosts and vCenter Server and reporting results
Nessus (is this enough by itself to address scanning or is another tool needed?)
Configuration Management Tool
(VMware Configuration Manager, others?)
Security Analytics Tool for logs and events
(example -  Log insight plus security pack or Splunk) -
Tool for authentication / password vault
Hytrust or similar
(add other areas / tools I missed here...)

Answer 1

Hello,
Re: Nessus
It can be used but only sees a little of the VE, it however will see your VM environment. Compliance is really about the workloads. What they touch and whether what they indirectly touch. Start with figuring out the actual scope of the compliance.
Re: Script
Not really it however hits the highlights. I plan on making it available somehow.
Re: HIPAA
Where are your workloads in relation to everything. Generally I would say Yes, but how is HIPAA handled today? First check that with your compliance folks. Compliance is really about the workloads. What they touch and whether what they indirectly touch. Start with figuring out the actual scope of the compliance.
Best regards,
Edward L. Haletky
VMware Communities User Moderator, VMware vExpert 2009, 2010, 2011,2012,2013,2014
Author of the books 'VMWare ESX and ESXi in the Enterprise: Planning Deployment Virtualization Servers', Copyright 2011 Pearson Education. 'VMware vSphere and Virtual Infrastructure Security: Securing the Virtual Environment', Copyright 2009 Pearson Education.
Virtualization and Cloud Security Analyst: The Virtualization Practice, LLC -- vSphere Upgrade Saga -- Virtualization Security Round Table Podcast