CASE STUDY
Receiving a favorable SOC 2 report with in-depth audit assistance
Miles IT helps a healthcare benefits organization follow SOC 2 compliance requirements and strengthen security control activities.
MEET THE CLIENT
Healthcare benefits organization
The client works in the healthcare benefits industry and handles deidentified patient data.
Because of their unique technology infrastructure and industry, they needed help demonstrating organizational security controls to receive SOC 2 accreditation.
PRIMARY GOALS
Demonstrate security standards through a SOC 2 audit
Though their existing documentation and controls were reasonable, the client wanted to ensure that their controls could be matched against the SOC 2 COSO framework.
Obtain Accredited SOC 2 Audit
The client sought to establish a clear, structured approach for their organization to receive accredited audits now and in future years.
Provide Evidence of Organizational Controls
With their unique technology environment, the client needed assistance clearly illustrating their control activities.
Meet Customer Requirements
To build trust and transparency among customers, it was essential to share the SOC 2 audit report when the engagement was complete.
OUR PROCESS
Thorough risk assessments & audit guidance
Under the leadership of our Director of Compliance and Risk Management, we performed several risk assessments to help the client prepare for SOC 2 accreditation and assisted them throughout the audit process.
HIPAA Risk Assessment
First, our team performed a HIPAA Risk assessment and an organizational risk assessment to gain clarity on the client’s evaluation of their risk levels.
SOC 2 Type I Audit Guidance
Next, we worked alongside the client to achieve a SOC 2 Type I audit report leveraging our years of experience in SOC 2 audits to ensure a smooth audit process.
Penetration Testing
After undergoing the SOC 2 Type I audit, we conducted penetration testing to determine ways the client could improve their security posture.
External Vulnerability Scanning
In an effort to continually improve its security posture, the organization engaged Miles IT for external vulnerability scanning services. This ultimately became a key artifact during the audit process to demonstrate other aspects of risk management and assessment.
SOC 2 Type II Audit Guidance
To help the client attain a SOC 2 Type II report, we provided guidance to the staff involved in the process. At times, we served as the intermediary between the auditor and the client to help “translate” the control needs and ultimately determine what was necessary to provide sufficient evidence.
The client is now on their third SOC 2 Type II audit; we continue to guide them through the process for a smooth audit every time.
OUR STRATEGY
Streamline audit approach & enhance controls
Leveraging our 13 years of experience undergoing SOC audits for ourselves and clients, we assisted the organization with assessments, documentation, and training to simplify the audit engagement.
Documentation Revisions
We reviewed, condensed, and rewrote parts of the client’s security policies & procedures, including a Disaster Recovery Plan (DRP), account policies, and incident response plans, to better align with operational methodologies.
Audit Process Training
Our team shared knowledge surrounding audit procedures, including how to respond to specific questions, appropriate types of artifacts to prove specific controls, and strategies for managing significant audit activities.
Third-Party-Vendor-Specific Risk Assessment Guidance
To better understand the oversight of third-party vendors, we guided the client through the process of conducting sub-service entity risk assessments, which involve reviews of SOC 2 audits & Vendor Security Posture Questionnaires.
Disaster Recovery Tabletop Test
As an additional scope item, we performed a tabletop test, where a specific business interruption scenario was discussed with participants to determine how their current plan dictated their response actions and the practicality of that plan.
THE RESULTS
Client obtained a favorable SOC 2 report & gained experience with the audit process
With our help, the client received SOC 2 accreditation and is now undergoing their third SOC 2 Type II audit.
Favorable Opinions on SOC 2 Type 1 & II Audits
The client received a SOC 2 Type I audit and two subsequent SOC 2 Type II audits, all with favorable auditor opinions.
In-Depth Knowledge of Audit Process
With a strong understanding of SOC 2 audit management, the client can take the lead on information and artifact gathering in the future.
Established Customer Trust
Now, the client’s customers can view the results of the audit and gain clarity on the presence and effectiveness of their control activities.
MOVING FORWARD
Continual accreditation & ongoing partnership
Since the client has a significant understanding of audit procedures, the Miles IT team now serves as their partner, allowing for mutual validation of controls and artifacts. We also provide recurring vulnerability scanning to help evaluate some of their technical controls.
If you’re looking for assistance with SOC 2 audits or another type of regulatory compliance, contact us to see how we can help.