Assessor Package: operator runbook from trial to ZIP

The Assessor Package is a tenant-scoped ZIP you download from the operator portal after you have a working trial. It is an evidence bundle for your assessor, not a certification, not a SOC 2 report, and not a substitute for live reproduction.

Path from trial signup to ZIP

1. Request Govern access and complete first sign-in.
2. Enroll at least one agent so execution and audit rows exist.
3. Run a signed script (or a platform example you duplicated).
4. Open the Assessor / evidence export surface in the portal (labels vary by build; search help for Assessor Package).
5. Download the ZIP. Keep it in a dated diligence folder.

If the tenant schema is still migrating, some annex files report queryStatus tenant_schema_unavailable instead of silently omitting rows. That honesty is intentional.

What to expect inside

txt, control honesty CSVs (for example Essential Eight quality labels), and feature annexes such as enabled procedure triggers (no webhook secrets) and probe-local vault-rail counts (no plaintext device secrets). Optional SVG figures may appear when count-mix data exists.

There is no PDF engine in the product; do not expect a branded SOC report in the ZIP.

Caps apply (for example trigger annex row caps). Large fleets are summarized, not dumped unbounded.

What the ZIP will never contain

• SOC 2 Type II reports or bridge letters
• Pentest executive PDFs
• Platform-decryptable network mutate secrets on the recommended probe-local path
• Another tenant’s audit rows

If a salesperson promises those files from the ZIP, they are wrong.

Operator checklist

• Confirm JWT tenant binding: a mismatched tenant header should 403 for portal users.
• Confirm RequireSigned behavior with an unsigned dispatch if that policy is on.
• Confirm Assessor ZIP hashes or file list in your workpapers.
• Record product version / dateModified of this guide.

Pair with live screenshots

The ZIP is not a screenshot of Security Center. Capture those fields separately using the screenshot guide. Assessors often want both: structured JSON and a UI still.

Scale note

Catalog and lookup APIs exist so the portal does not load 100k agents into a dropdown. Assessor annexes are similarly capped. If you need a full audit export, use the audit export job, not the Assessor ZIP, for complete history within retention.

After you download

Store the ZIP with access control. It can contain tenant metadata even when secrets are stripped. Treat it as diligence material, not a public marketing asset.

Field notes (Assessor ZIP operators)

If an annex says tenant_schema_unavailable, finish migrate and retry. Do not invent missing rows. Caps on trigger and vault-rail annexes are intentional at fleet scale. Use audit export jobs for full history within retention. Probe-local vault counts never include plaintext device secrets.

Date the diligence folder YYYY-MM-DD and record the portal product version. Re-export after upgrades. Do not reuse last week's grant token. Public starter PDFs copy without email. Gated files need a live grant. If the Platform API is down, HubSpot may still capture the lead with no download buttons. Say that out loud so GRC does not think the trial is broken.

Walk one denied unsigned dispatch when RequireSigned is on. Capture a 403 from a mismatched tenant header. Export audit for one window and confirm no foreign tenant codes. Open the Assessor ZIP trust-artifacts.json and read the limitations appendix. Leave Gap rows as Gap. Do not paste LabVerified for Entra, Okta, Stripe, or SMTP until the capability verification registry says LabVerified.

Keep the incumbent RMM. Trustholm does not replace OS patching, remote takeover, or a NOC hero pitch. Probe and observe features are operator tools, not the reason a council or insurer should buy. Named design-partner logos stay off marketing pages until attestation exists.

Store ZIP files with access control. They hold tenant metadata even when secrets are stripped. Email security@trustholm.com only for Manual DPA or pentest summary. Do not invent those PDFs on www.

If someone asks to select all agents in a dropdown, stop and show catalog pagination. If someone asks for a second region or a single global edge FQDN, say Phase 1 Australia edge is current and global discovery is deferred.

Copy the trust hub sentence into the packet: we do not hold SOC 2 Type I or Type II and do not claim an observation period. Trustholm supplies technical artifacts for the customer's program. It does not automate customer SOC 2 Trust Services Criteria like a GRC product.

Assign an owner to refresh this packet quarterly or after a Shipped/Gap change. Workshops go stale. Prefer live reproduction over architecture slides. Prefer export files over screenshots alone, then keep both.

If an annex says tenant_schema_unavailable, finish migrate and retry. Do not invent missing rows. Caps on trigger and vault-rail annexes are intentional at fleet scale. Use audit export jobs for full history within retention. Probe-local vault counts never include plaintext device secrets.