SOC 2 Compliance & What You Need to Know

Why Get Compliant?

SOC 2 was not a mandatory security framework for ValorTech—we were not under a legal or regulatory requirement to be compliant. Achieving a SOC 2 attestation is a way for our organization to showcase our dedication to cybersecurity and privacy. For years, ValorTech has operated under formal security controls and processes, but it’s incredibly helpful to get an outside opinion on those practices. 

In the competitive field of managed security services, SOC 2 compliance can differentiate an organization from its competitors; it can instill client confidence, build stakeholder trust and help an organization remain ahead of regulations. The successful realization of our SOC 2 Type II report verifies the measures we have in place to protect client’s data. 

Retaining an annual SOC 2 Type II audit will confirm our commitment to ongoing assessment and improvement of our security posture as our organization continues to grow. 

What is SOC 2?

SOC 2 is a cybersecurity compliance framework and audit report developed for service and technology providers that handle client data. A SOC 2 audit scrutinizes an organization's policies, procedures and information protection systems across five Trust Services Criteria categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. Designed by the American Institute of Certified Public Accountants (AICPA), SOC 2 offers a verified method for evaluating and certifying an organization’s security infrastructure. The proof is a SOC 2 report—a living document providing interested parties and clients information about an organization’s commitment to security.

What is the Difference Between SOC 2 Type I and SOC 2 Type II?

SOC 2 Type II is not just a one-time attestation, but a continual compliance journey. It assesses the effectiveness of security processes by observing operations over a period of up to 12 months, offering a more comprehensive view of an organization’s security practices. In contrast, with a SOC 2 Type I audit, an organization’s cybersecurity controls are assessed at a single point in time, usually shortly after they’ve been implemented.

What Was the Attestation Process?

In early 2023, we began evaluating our organization's current security practices, policies and procedures against the SOC 2 framework with the goal of becoming compliant by mid-2024. 

Secureframe, an all-in-one compliance framework platform, helped us automate the collection of our controls evidence, centralize documentation and identify areas of non-compliance. The evidence collection process included but was not limited to the following: creating policies, training personnel on security and privacy requirements, scanning and securing cloud services, documenting network configurations, documenting and verifying logical access, identifying disaster recovery and incident response plans, and assessing and managing vendor risks. 

Secureframe’s team of experts conducted a readiness assessment to determine if we had met the necessary criteria and controls to undergo a full audit. An impartial auditor was then engaged to assess the evidence. Once it was determined that ValorTech’s service commitments and system requirements were achieved in accordance with the trust services criteria, we received our SOC 2 Type II report.

Who Did We Partner With?

Our audit was completed by Johanson Group, LLP, a licensed CPA firm and trusted partner in comprehensive audit and security compliance services. Johanson Group, LLP helped us navigate the complexities of certification seamlessly. Sprocket Security, Inc. assisted us in meeting the penetration testing requirements. Sprocket Security, Inc. employs a blend of attack surface management and humans to detect change and perform testing. Continuous penetration testing is performed, though only an annual penetration test is required for SOC 2 compliance. ValorTech has a rigorous change management process established for tracking and mitigating any findings. 

Secureframe acts as a central repository to track and hold evidence for our entire compliance program, providing us a holistic view into our security infrastructure. Native integrations with our tech stack and Secureframe’s automated control testing capabilities collect evidence to continuously monitor compliance to the SOC 2 framework. This helps us remain audit-ready and ensures our data is well protected.

Want to Learn More?

If you’re interested in becoming SOC 2 compliant, email info@valortech.io to learn more about our compliance consulting services.