Corticare is a California based tele-Electroencephalogram (EEG) company with a premise to help technicians determine real brain functionality and abnormality in a timely and cost-effective manner. Corticare has redefined remote EEG monitoring in critical care and the Epilepsy Monitoring Unit (EMU), expanded the use of in-home ambulatory EEG and provides support for clinical trials. Corticare continues to serve as the industry leader in neuro-telemetry by setting the standard for processes, personnel, and innovation.
Corticare was faced with the challenge of providing evidence to current and prospective customers that it had undergone thorough security due diligence and data protection measures against cyber-attacks. Corticare quickly decided it would pursue compliance with a security framework, but a subsequent challenge was finding a compliance standard that was most appropriate for accomplishing the goal. After consulting Jacobian Engineering for expert advice, both parties decided on Service Organization Control 2 (SOC 2) as the most appropriate solution.
Service Organization Control (SOC) is a compliance standard for service organizations which was developed by the American Institute of CPAs (AICPA) and specifies how organizations should manage customer data. The standard is based on the following trust criteria: security, availability processing integrity, confidentiality and privacy.
The SOC 2 framework is built on five Trust Services Criteria (formerly called the Trust Services Principles), defined by AICPA. These Trust Services Criteria are the basic elements of your cybersecurity posture. They include organization controls, risk assessment, risk mitigation, risk management, and change management. Security is the only TSC required for every SOC 2 audit. Additional criteria are optional.
The five Trust Services Criteria are:
The Security TSC is all about protecting information and systems. Is data secure during its collection or creation? Is it secure during its use, processing, transmission, and/or storage? How does a company prevent and monitor any vulnerabilities in its systems? The SOC 2 Common Criteria list, also known as the CC-series, includes nine subcategories
Corticare chose to report on the Common Criteria only and Jacobian Engineering worked with Corticare to develop controls in each of the subcategories. Amazon Web Service platform and infrastructure services helped Corticare rapidly implement controls and meet or exceed the standards outlined by the AICPA. Certain control subcategories are largely administrative, such as:
But most of the control subcategories are supported by AWS services including:
Jacobian Engineering's compliance auditors completed the readiness for SOC 2 and submitted all documents for the Audit firm chosen by Corticare. Through the entire process, Jacobian Engineering continued working and assisting Corticare with responding to questions and requests from the Audit firm. Corticare achieved SOC 2 compliance.
This SOC 2 achievement has improved the overall security posture of Corticare, increased growth opportunities and helped Corticare maintain its competitive edge.
Jacobian Engineering is an information security company and an AWS Advanced Tier Services Partner. Jacobian Engineering works with customers in several industries including healthcare, biotechnology, energy, financial services, construction and has strong competencies in cloud security, software development, migrations, governance, risk, and compliance.
Challenge: CortiCare, a tele-EEG monitoring company, needed to demonstrate robust security measures to customers and prospects through a recognized compliance framework. Solution: Jacobian Engineering guided them through SOC 2 compliance using AWS services, resulting in improved security posture and competitive advantage.