We're proud to announce that Tec-Refresh has successfully completed a SOC 2 Type II examination conducted by independent audit firm Insight Assurance. The resulting report confirms that the controls we use to protect our clients' data and systems were suitably designed and operated effectively over the audit period of [start date] to [end date].
It's a milestone we're especially glad to share during Cybersecurity Awareness Month. All October, we've written about moving security beyond awareness and into practice. This is us holding ourselves to the same standard.
Why this matters for a managed security provider
As a managed security services provider, we don't just advise on security. We operate inside our clients' environments. Our teams manage infrastructure, monitor networks, and respond to threats for state and local agencies, healthcare organizations, manufacturers, and financial services firms.
That level of access comes with a responsibility. The organizations we work with trust us with the systems their communities, patients, and customers depend on every day. That trust should be verified independently, not simply assumed.
What a SOC 2 examination covers
SOC 2 is a reporting framework developed by the American Institute of Certified Public Accountants (AICPA). It evaluates how a service organization protects the information it handles, based on the Trust Services Criteria. Our examination covered the Security criteria, which address how systems and data are protected against unauthorized access.
Through the examination, Insight Assurance reviewed our policies, tested our controls, and examined evidence of how those controls work in practice, from access management and change control to monitoring and incident response.
What it means for our clients
Faster vendor due diligence. Our SOC 2 report answers many of the questions in a typical security questionnaire, which can shorten procurement and vendor review cycles.
Support for your own compliance obligations. Many of our clients are required to oversee the security of their service providers, whether under the SEC's Regulation S-P, HIPAA business associate requirements, or public sector procurement rules. An independent SOC 2 report gives your team documented evidence for those reviews.
Confidence in the controls protecting your environment. The safeguards we apply to your systems have been tested by a qualified third party, not just described in a policy.
Our thanks to Insight Assurance
We extend our sincere appreciation to Insight Assurance for their thorough, independent examination. Their expertise and rigor gave us a clear, objective view of our control environment and helped confirm that our practices meet the standards our clients expect.
We also want to thank our own team. Completing a SOC 2 examination takes months of preparation, documentation, and day-to-day discipline across every part of the business.
An ongoing commitment
A SOC 2 report isn't a finish line. We'll continue to undergo regular examinations, refine our controls as threats and client needs evolve, and apply the same rigor to our own operations that we bring to yours.
Clients and prospective clients can request a copy of our SOC 2 Type II report and review our security practices through the Tec-Refresh Trust Center.