Blue Heron Digital Services

Blue Heron Digital Services, LLC · Lakeland, FL

SOC 2 Readiness Check

27 plain questions across Access control, Change management, Logging, Incident response, Vendor management, Backups, Policies, and Devices and data. Answer yes, partly, or no. You get a readiness score out of 100. This is not a SOC 2 audit. We reply within 2 business days.

Looking for a cloud bill? Use Cloud Bill Check.

Access control

Do you require multifactor authentication for email and for admin sign-in?
When someone leaves, do you remove their access within a few business days?
Do you review who has admin access at least twice a year?
Are shared passwords forbidden for systems that hold customer data?
Do you limit production access to people who need it for their job?

Change management

Are production changes reviewed by someone other than the person who made them?
Can you tell what changed in production and who changed it?
Do you test changes before they reach customers?
When a port is opened to the internet, does someone review that choice?

Logging

Do you keep security and admin logs for at least 90 days?
Does someone look at alerts for failed admin sign-ins?
Is there a named person for security alerts?

Incident response

Do you have a written incident plan?
Have you practiced or used that plan in the last year?
Do you record incidents and what you changed afterward?

Vendor management

Do you keep a list of vendors that store or see customer data?
Do you review a vendor's security before you sign, and again when you renew?

Backups

Are important systems backed up on a schedule?
Have you restored from a backup in the last year?
Do you know who is told if a customer-facing system is down?

Policies

Do you have written security policies that employees can read?
Do new hires acknowledge those policies?
Is there a named owner for security?
Do you patch operating systems and apps on a set schedule?

Devices and data

Are laptops that hold customer data encrypted?
Can you cut off a lost laptop?
Do you know where customer personal data is stored?

The free page shows the score and the gap categories. The question-by-question plan is in the paid Cloud Cost Audit. You make the changes yourself. Scott replies within 2 business days.