Business Operations Transformation and SOC 2 Operational Compliance
The Situation
A Data Analytics start-up required a re-structuring of tech and non-tech operations to set themselves ready for a SOC 2 Type 2 audit and aim to receive an attestation report that leadership could then use in conversations with potential customers as well as investors.
The challenge presented was to keep the organisation flat, without having to setup dedicated functions such as HR, Operations and Compliance Management, therefore retaining overall business agility while structuring all the required controls.
The Task
The end-to-end engagement was purposely split into two separate phases; 1st phase completed in 4 weeks, while 2nd phase had a lead time of 8 months to include a 3-month-long review period by the auditor.
Phase #1: Gap Analysis & Roadmapping
- Kick Off meeting
- Functional assessment
- Procedural assessment
- Listing of mission-critical tech vendors
- Listing of tools
- Security posture assessment
- Evaluation of external SOC 2 auditors
- Gap analysis
- SOC 2 attestation plan/roadmap
Phase #2: Development of Controls & Evidence
- Initiation & Setup
- Appointment of the independent reviewer/auditor
- SOC 2 Readiness Build
- Readiness Assessment & Fieldwork
- Readiness Review & Remediation
- Type 2 Audit & Fieldwork
- Final Type 2 Audit Report Review
The Action / Approach
- Gap analysis of existing controls and documentation relevant to a future SOC 2 audit.
- Transformation of business operations across Product Development, Engineering, HR.
- Development of technology-based and procedural controls relevant to Information Security, People Management and operational governance.
- SaaS implementation of a Managed Security Awareness Training (MSAT) programme so that all employees are regularly tasked to carry out training and online refresher courses around cyber threats as well as protection of sensitive and personal data.
- SaaS implementation of an Endpoint Detection & Response (EDR) platform with Threat Intelligence to detect and isolate all suspicious activities running on any of the company workstations.
The Result
- Full set of documented procedures developed, reviewed, submitted for consumption to all staff and ultimately accepted by the auditor.
- Roll-out of the new MSAT programme based on KnowBe4 technology platform.
- Security Awareness Training completed by all staff (including C-suite team members).
- Roll-out of SentinelOne Singularity EDR platform integrated with the ticketing system to generate incidents requiring investigation and resolution.
- SOC 2 audit + review period completed with all required evidence submitted and accepted; the company received their Attestation Report released by the independent auditor proving the operational alignment with SOC 2 (Type 2) requirements.
