Building a SOC 2-Ready Cybersecurity Program

The Challenge

A program management firm supporting the energy sector needed to strengthen its cybersecurity program and prepare for SOC 2 certification. The effort was important to maintaining a critical relationship with a major utility customer and demonstrating that the company had the security controls and processes expected of its partners.

The company had an existing security foundation, but gaps remained across policies, procedures, technical controls, risk management, and audit documentation. Its AWS environment also required ongoing security monitoring and management.

With a lean internal team, the company needed experienced cybersecurity leadership that could assess the current environment, establish priorities, close gaps, prepare the organization for an independent SOC 2 audit, and continue managing security after the initial readiness effort.

KITC's Role

KITC served as the company's virtual Chief Information Security Officer (vCISO) and provided ongoing cybersecurity and AWS managed services.

The engagement began with a comprehensive cybersecurity risk assessment. KITC evaluated all 104 NIST Cybersecurity Framework controls, using stakeholder interviews and policy reviews to assess the design and effectiveness of existing controls.

The team then mapped the assessment findings to SOC 2 Type I and Type II requirements, identified gaps, and developed a remediation roadmap based on risk and audit priorities.

KITC worked directly with company leadership and IT personnel to implement the required changes. This included strengthening technical configurations, formalizing security processes, implementing controls, managing identified risks, and preparing the organization for third-party assessment.

Building the Security Program

A major part of the engagement had been turning security practices into a documented, repeatable cybersecurity program.

KITC developed more than 40 cybersecurity policies, plans, procedures, and supporting documents needed to formalize the company's security program and prepare for SOC 2. These deliverables covered areas including cybersecurity risk management, incident response, supply chain risk management, contingency planning, change management, and vulnerability management.

KITC also established an ongoing approach to vulnerability management, control validation, vendor risk management, penetration testing coordination, and security reporting.

As vCISO, KITC provided the senior-level security oversight needed to keep these activities moving. The team worked with management on cybersecurity priorities, tracked remediation activities, coordinated audit preparation, and provided guidance as security and compliance requirements change.

Securing and Managing the AWS Environment

KITC's responsibilities extended into the company's AWS environment, where the team provided hosting, monitoring, security, and ongoing managed services.

KITC implemented and managed cloud security capabilities for identity and access management, threat detection, logging, configuration oversight, encryption, backup, and vulnerability management. The environment was continuously monitored to identify security issues and maintain visibility into hosted workloads.

The team also reviewed AWS consumption and performance to identify opportunities for cost and operational improvements, giving the company ongoing cloud management alongside its cybersecurity program.

The Results

• SOC 2 readiness established. KITC completed the assessments, gap analysis, remediation planning, control implementation, and documentation needed to prepare the company for SOC 2 Type I and Type II audit activities.

• 104 cybersecurity controls assessed. KITC conducted a detailed review of the full set of NIST Cybersecurity Framework controls, giving the company a documented view of its security risks, control effectiveness, and remediation priorities.

• 40+ cybersecurity documents developed. KITC built the policies, plans, procedures, and program documentation needed to formalize security operations and support ongoing compliance.

• A critical customer relationship protected. Improvements to the company's cybersecurity and compliance posture helped it meet security expectations associated with a major utility customer and maintain that important business relationship.

• Senior cybersecurity leadership through vCISO services. KITC served as the company's vCISO, providing senior cybersecurity guidance, risk management, compliance oversight, remediation planning, and coordination with internal teams and external assessors.

• AWS security and operations managed as part of the program. KITC provided ongoing monitoring, vulnerability management, cloud security, and cost oversight for the company's AWS-hosted workloads.

  
  

Building a Stronger Cybersecurity Foundation

What began as a need to address security gaps and prepare for SOC 2 developed into a broader cybersecurity program spanning risk management, policies and procedures, technical controls, vendor risk, AWS security, and audit preparation.

Through its vCISO and managed security services, KITC helped the company establish the structure, documentation, and security practices needed to strengthen its cybersecurity posture, support SOC 2 readiness, and meet the security expectations of a major utility customer.