{"id":26898,"date":"2025-01-14T20:14:15","date_gmt":"2025-01-14T20:14:15","guid":{"rendered":"https:\/\/peraltafinancing.com\/accounting\/softdocs-levels-up-their-compliance-program-with-stateramp\/"},"modified":"2025-01-14T20:14:15","modified_gmt":"2025-01-14T20:14:15","slug":"softdocs-levels-up-their-compliance-program-with-stateramp","status":"publish","type":"post","link":"https:\/\/fivemor.com\/?p=26898","title":{"rendered":"Softdocs Levels Up Their Compliance Program with StateRAMP"},"content":{"rendered":"


\n<\/p>\n

\n
\"\"<\/div>\n

by Hannah Grace Holladay \/ July 15th, 2024 <\/p>\n

Audits are hard, but when you partner with a firm like KirkpatrickPrice, it will be worth it. <\/p>\n

That\u2019s exactly what Softdocs <\/a>learned when they asked us to be their partner on their newest compliance initiative: become compliant with the NIST 800-53<\/a> framework via a StateRAMP audit within one year.\u00a0Learn exactly how we worked together to make sure this audit journey ended in success. <\/p>\n

About Softdocs<\/h2>\n
\"\"<\/figure>\n

Softdocs provides process automation and document management solutions to schools, states, counties, and cities. Their solutions enable colleges, universities, K-12 school districts, and state and municipal governments to improve how they serve people, create new efficiencies, and enable the future of work.\u00a0<\/p>\n

\n
\n

Challenge<\/h2>\n<\/p>\n
\n

Comply with NIST 800-53 in one year.<\/strong><\/p>\n<\/div>\n<\/div>\n

\n
\n

Solution<\/h2>\n<\/p>\n
\n

A customized roadmap to compliance.<\/strong><\/p>\n<\/div>\n<\/div>\n

\n
\n

Outcome<\/h2>\n<\/p>\n
\n

More clients and more secure data.<\/strong><\/p>\n<\/div>\n<\/div>\n

\n

The Details<\/strong><\/h2>\n

Implement and Comply with a Brand-New Framework in Under a Year<\/strong><\/h3>\n

Softdocs wanted to increase their cybersecurity posture.\u00a0 They are always looking for ways to level-up their security program because keeping their client\u2019s data safe is their number one priority.<\/p>\n

They set an aggressive goal to create a more secure cloud infrastructure that is compliant with the NIST 800-53<\/a> framework via a StateRAMP audit within one year.\u00a0<\/p>\n

Partner with Experts to Create a Custom Roadmap to Success<\/strong><\/h3>\n

Softdocs started looking towards NIST compliance in Sept. 2022, beginning with a \u201cself\u201d gap analysis.\u00a0 During the process, the Director of Operations and Compliance Officer, Terri McKinney noted that, \u201cIt\u2019s too hard to do alone; you need guidance.<\/strong>\u201d She said that after working through StateRAMP\u2019s 320 controls alone, she knew that Softdocs needed KirkpatrickPrice to partner with them to provide expertise and guidance as they began this challenging compliance journey.<\/p>\n

Softdocs began working with KirkpatrickPrice in 2018 on a SOC 2 Type II<\/a> project.\u00a0 They\u2019ve had successful audits for 5 years in a row and were able to build a great foundation with their auditor, Herbert\u2019s<\/a>, guidance.\u00a0<\/p>\n

So, when it came time for their NIST 500-83 project, Terri knew that she wanted to partner with us.<\/p>\n

\n

\u201cWe selected KirkpatrickPrice because we don\u2019t feel like a number with them; it\u2019s truly a partnership.\u00a0 Our audit gives us expert advice on what we need to do to increase our level of security.\u201d<\/p>\n<\/blockquote>\n

Together, we determined the scope of the project and set 4 milestones:<\/p>\n

1. Asset-Based Risk Assessment<\/strong><\/p>\n

Softdocs\u2019 auditor, Herbert, flew to their office in Columbia, South Carolina to work with them on an asset-based risk assessment.\u00a0 Together, they determined that Softdocs\u2019 cloud environment needed to be measured against the NIST controls.\u00a0 The risk assessment gave the team the assurance that they were applying the controls correctly and that the project would be focused on the right areas of Softdocs\u2019 program.<\/p>\n

2. Gap analysis<\/strong><\/p>\n

There are 320 controls for StateRAMP, and Herbert, Terri, and the Softdocs security team went through all of them in one week to identify any gaps in the Softdocs program.\u00a0 They compared Softdocs\u2019 current security program to all 320 controls to identify any areas they needed to improve. \u00a0\u00a0<\/p>\n

3. Remediation<\/strong><\/p>\n

Because of the great foundational work Softdocs has done with KirkpatrickPrice over the last five years, they luckily had all the big things in place.\u00a0 The gap analysis highlighted some areas they could improve with small changes and prepared them to face the audit with confidence.\u00a0 Herbert guided them through this process, so they were sure that their controls were properly designed.<\/p>\n

\n

\u201cHerbert did a great job interpreting controls and then helping us implement them into our environment.\u00a0 He was the guiding force determining how each control related to our specific environment.\u201d<\/p>\n<\/blockquote>\n

4. The Audit<\/strong><\/p>\n

Their audit started December 2023 and concluded in April 2024, meaning Softdocs met their goal of completing the audit by 2024! \u00a0The audit followed KirkpatrickPrice\u2019s consultative audit approach, ensuring Softdocs was never alone during their audit.\u00a0<\/p>\n

Lead Practitioner Herbert McMorris and Client Success Manager Emily Buser partnered with Softdocs during their entire audit process.\u00a0 They organized the project, ensured they stayed on track, and provided a safe space for the team to candidly work through the challenging portions of the audit.<\/p>\n

Though the audit was one of the largest challenges Softdocs has faced, Terri said it was 100% worth it.\u00a0 By setting such an aggressive goal, Softdocs almost \u201cforced their own hand,\u201d Terri said.\u00a0 There are always ways to improve, but it\u2019s tough to do because \u201cit\u2019s way easier to drag your feet than level-up your entire security program.\u201d\u00a0 This audit deadline made them commit to the process.\u00a0 It took every person in the organization to buy in to the process for it to be successful, but it was absolutely worth it. They knew it wasn\u2019t going to be easy, and it didn\u2019t disappoint. They did the hard work and are reaping the rewards.<\/p>\n

\n

\u201cYou can\u2019t do it without a team, and KP has delivered.\u201d<\/p>\n<\/blockquote>\n

Win New Business by Leveling Up Your Security Program<\/strong><\/h2>\n

After successfully completing their StateRAMP audit, Softdocs has proven how seriously they take security and why that is so critical to their success.\u00a0<\/p>\n

\n

\u201dWe are dedicated to implementing the processes necessary to hyperfocus on security all year long, not just during an audit.\u201d<\/p>\n<\/blockquote>\n

They have also been able to win new business<\/a> with their NIST compliance, claiming it is the differentiator between them and their competitors.<\/p>\n

Softdocs understands the importance of security to the success of their business.\u00a0 They know it makes a difference in the quality of work they can provide to their customers, and in the types of customers they attract.\u00a0 We\u2019re proud to be their partner in compliance and look forward to working with them in the future to continuously elevate their security practices.<\/p>\n

\n

\u201cOrgs should embrace the work that an auditing firm brings to the table. Wouldn\u2019t you much rather your auditor find a problem than an evil actor looking for a hole that you haven\u2019t plugged?\u00a0 That to me is the most important thing.\u201d<\/p>\n<\/blockquote>\n

Level up your security program with KirkpatrickPrice.<\/strong><\/h2>\n

Audits are hard, but when you work with an expert who\u2019s been in your shoes, it will always be worth it.\u00a0 KirkpatrickPrice will be your partner in compliance so you can be confident that your cybersecurity and compliance audit will end in success.<\/p>\n

Connect with an expert today to learn what it\u2019s like to have a true partner in compliance.<\/p>\n

Together we can: \u00a0<\/p>\n