Question 1

Can you also be our auditor?

Accepted Answer

No — auditor independence rules mean we can't audit what we built. We are your consultant; we hand off to an independent auditor.

Question 2

How long does SOC2 Type II take?

Accepted Answer

Type I (point-in-time): 8-12 weeks. Type II (operating effectiveness over time): plan for 9-12 months total including the observation window.

Question 3

Do you do the pen test in-house?

Accepted Answer

Yes. Red team work is delivered by the same hands that built your controls, which closes the feedback loop fast. For standalone or annual pen tests outside a compliance engagement, see our Penetration Testing service.

Question 4

What's NYDFS Part 500 about?

Accepted Answer

It's New York's cybersecurity regulation for financial services companies — banks, insurers, money transmitters, mortgage lenders. Annual cert to the DFS, named CISO, written policy, MFA, encryption, IR plan, vulnerability management. Strict and getting stricter.