OAC Technology is a SOC 2 compliant managed service provider. Every year since 2018, outside auditors examine how we handle data inside our own company and how we handle our clients’ data. We have been supporting Minneapolis and St. Paul businesses since 2000, and that annual audit is part of how we stay accountable for the access we are trusted with.
SOC 2 stands for System and Organization Controls 2. It is a framework developed by the American Institute of Certified Public Accountants (AICPA) for auditing how a service organization protects customer data. It is built around five Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy.
A SOC 2 audit is not a checklist a company fills in about itself. It is an examination performed by an independent, AICPA-accredited CPA firm, which reviews the organization’s actual controls, policies and evidence, and then issues a report. Compliance is maintained through annual assessment, not earned once and kept forever.
If you want the longer explanation, we wrote one: What is SOC 2 Compliance?
Your managed service provider holds administrator credentials to your network. They can reach your email, your file storage, your backups and your servers. In practical terms, an MSP has broader access to your business data than almost any other vendor you work with.
That creates a straightforward problem. You can invest heavily in your own security posture and still inherit risk through the provider you hired to protect you. Supply chain compromise, which attacks a service provider to reach a company’s clients, is a well-documented pattern of attack against MSPs specifically.
Asking whether your provider is independently audited is a reasonable question. So is asking what the audit covered.
Those questions are worth asking us too. We would rather work with clients who ask them.
Being audited annually changes day-to-day practice, not just documentation. It means access to client systems is controlled and reviewed rather than shared informally. The way we store, transmit and dispose of data follows written policy. And when something changes, the change is recorded.
Some of this is visible in the services themselves. For example, our cloud backup service stores data offsite with encryption that meets or exceeds SOC 2, HIPAA and NIST standards for backups. Our managed cybersecurity services apply layered controls across email, perimeter, internal systems and endpoints. And our network security services help businesses implement best-practice controls and maintain regulatory compliance.
And when a customer or insurer questionnaire asks about your vendors, you can point to an independent audit rather than a promise.
A number of our clients carry compliance obligations of their own. We regularly work alongside businesses that need to meet:
We are not an audit firm and we do not issue attestations. What we do is build and operate the underlying technical controls those frameworks expect, namely access management, encryption, monitoring, logging, patching, backup and recovery. And we will provide the evidence your auditor asks for. Where your obligations extend beyond technology into policy and process, we will tell you plainly where our role ends. That side is what our vCISO service covers.
Recovery planning is part of that picture as well. Most frameworks expect a tested ability to restore operations, which is what our business continuity services are designed to provide.
No. Your compliance depends on your own controls, policies and audit. Working with a compliant provider helps by removing a significant source of inherited risk and means the systems we manage on your behalf are already operated under audited controls. But that SOC 2 compliance does not transfer to you. Any provider suggesting otherwise is overselling.
SOC 2 applies to service organizations that handle other companies’ data, so it depends on what you do rather than how large you are. Many small software and technology firms pursue it because enterprise customers require it before signing. If nobody is asking you for a report, you probably do not need one. But the security practices underneath it are worth adopting regardless.
No. They are separate frameworks with different scopes and different authorities behind them. SOC 2 is an AICPA auditing framework for service organizations. HIPAA is US healthcare law. PCI DSS is a payment card industry standard. Meeting one does not mean meeting another, though the underlying security controls overlap considerably.
Annually. Each year an independent CPA firm reassesses the organization’s controls. This is why the date on a report matters. Compliance describes a specific period, not a permanent status.
Yes, short of the audit itself. OAC is not an audit firm and does not issue attestations. Its vCISO service runs the readiness work: a gap analysis against the Trust Services Criteria, written policies, evidence collection and support during the examination, while managed IT services put the technical controls in place. A vCISO assessment typically begins within a couple of weeks and produces a baseline and roadmap within the first one to two months.
If you are evaluating managed IT providers and compliance is part of your decision, we are happy to walk through what our audit covers and how we would handle your environment. If you are working toward a compliance requirement of your own, we can talk through what the technical side involves before you commit to anything.
Call 952-548-5558 or contact us for a free consultation. You can also estimate costs first with our managed IT services pricing calculator.
Related services: managed IT services, managed cybersecurity, network security, cloud backups.
