Software: Our SOC 2 journey

SOC stands for System and Organization Controls. It is a standard when dealing with customer data. SOC is a means of verifying a set of standardized controls that are defined by the American Institute of Certified Public Accountants (AICPA). SOC is used to validate the controls that a company utilizes internally to their clients. You will see how automating and exposing this information would benefit a company.

For SOC 2, the main components to being successful and staying successful are threefold. One, a good centralized documentation center (a place to store all of your reviews, and controls). Two, a way to automatically update and verify controls. Three, a good auditor that can work with you and make sure that you are successful. SOC 2 is something that you have to continuously do and publicize so that your clients can see that you are compliant.

At

During the process of acquiring our SOC 2 certification we established a security team that meets monthly for risk assessments, quarterly for access reviews and annually for DR testing. Having good tools in our employ did make this process straightforward. For example our access reviews, we utilize a tool called StrongDM for server access, Kubernetes access, and others. We have a centralized place in which to look for specific access and who has it. Tools do help make getting SOC 2 certification simpler especially if you have a single pane of glass for your auditors to look at.

When we set out to get our SOC 2 certification it was because we knew it would be a great way to announce to our clients that we are consistently following a set of standardized controls. To say that we practice safe means of handling data of all types internally and externally. SOC 2 can help reduce some of the apprehension that most security teams have about companies that access any type of data. From our perspective any tool that we want to utilize has to at least be SOC 2 compliant.

If you want to check out our live security report, you can click on this link: https://app.drata.com/security-report/42b97aed-d394-4c1d-b749-4fe65ab025b9/19559124-3354-46f7-bbd2-1313d773fb36?region=NA