SOC 2 Overview
A Service Organization Controls (SOC) 2 audit examines the controls an organization has in place to protect and secure its system, or services used by customers or partners. An organization’s security is assessed based on the requirements within a SOC 2 examination, known as the Trust Services Criteria (TSC). The is the governing body of the SOC framework and they set the U.S. standards that auditors follow for SOC 2 examinations.

The report assesses if a company’s controls are appropriately designed and working under the five TSC. They include:

• Security
• Availability
• Processing Integrity
• Confidentiality
• Privacy

Security is the only TSC that must be met in the SOC 2 report. The other four are optional but are usually added depending on the type of service(s) that an organization offers. This versatility is essential because SOC 2 reports are meant for use across all industries.��No matter the nature of the business, the focus is on securing digital information.

There are��, Type 1 and Type 2.

• SOC 2 Type 1��evaluates an organization’s cybersecurity controls at a single point in time. The goal is to determine whether the internal controls put in place to safeguard customer data are sufficient and designed correctly. Do they fulfill the required TSC? Type 1 audits and reports can be completed in a matter of weeks.
• SOC 2 Type 2 examines how well a service organization’s system and controls perform over a period of time (typically 3-12 months). What is their operating effectiveness? Do they function as intended? Type 2 audits can take 12 months to complete and are costlier than Type 1 audits.

How Does SOC 1 Differ From SOC 2?
SOC 1 Type 2 is an audit 911�Թ� undergoes annually. It focuses on financial controls instead of data security. If a company uses a third-party service provider to perform crucial financial reporting processes (e.g., an outsourced payroll management system or a revenue reporting platform), the company will likely ask those service providers for a SOC 1 report. As a bill review provider conducting payment processing services on behalf of clients, 911�Թ� frequently provides our SOC 1 report to customers.

Like SOC 2, there are two levels of SOC 1 audits:

• SOC 1 Type 1 evaluates the fairness of management’s description of the service organization’s system and the suitability of the design of the controls to achieve the related control objectives included in the description, as of a specified date.
• SOC 1 Type 2 evaluates the fairness of management’s description of the service organization’s system and the suitability of the design��and operating effectiveness��of the controls to achieve the related control objectives included in the description throughout a specified period.��Type 2 audits are much more robust than Type 1. Type 2 audits actually evaluate if a company is doing what it says over a period of time.

HITRUST Overview
Founded in 2007, the, or��, is a not-for-profit organization advocating programs that protect sensitive information and manage information risk.

While the HITRUST Common Security Framework (CSF) is designed for all industries,��it is closely associated with the healthcare industry’s challenges, such as the numerous applications of controls specific to healthcare (e.g., ). Overall, the HITRUST framework is used as a guide by organizations that deal with��or ePHI. The����was a response to the need to have more consistency in certifications. The aim is to have a standard regulation and risk management framework.

HITRUST CSF consolidated the varying requirements from ,��, , , and and checks for the following:

• The presence of clearly defined procedures and policies
• Capability testing to prove its implementation
• Demonstration of a company’s ability to measure and manage these controls

Compliance with this framework��ensures the protection of sensitive ePHI.��This is why meeting the HITRUST CSF requirements is vital to stay on top of all relevant regulations and standards.

Both SOC 2 and HITRUST reports revolve around the protection of sensitive personal data.��One main difference is that SOC 2 is an attestation report, while HITRUST is a certification.

Attestation Report (SOC 2)
An attestation report discusses the confirmation of management that the information in the report is accurate. An independent author will then confirm this report with the help of an opinion. The opinion in the SOC 2 report can be clean, unqualified, qualified, or adverse. Qualified means that the testing cannot confirm that at least one objective has been identified by management. Adverse implies that the testing has failed to verify most of the purposes outlined by management. Even though it may seem it has an asterisk beside it, a qualified report is still reliable. But the company must follow up on it to prove that remediation steps have been undertaken to address any issues raised in the qualified report. SOC 2 reports are completed yearly and may go on from one to three months from completion to report delivery. This depends on how promptly the SOC 2 client can provide documentation and the evidence needed for testing.

Certification Report (HITRUST)
The HITRUST report differs from SOC 2 because it comes with a certification. It has more details peppered in with the report��with five times more controls as it incorporates requirements from numerous standards within the HITRUST CSF. Within the HITRUST report, the organization’s management needs to submit a Letter of Representation instead of the management assertion inscribed within the SOC 2 report. This Letter of Representation is still collected within the SOC 2 report but is not included in the final report. The opinion in the HITRUST Certification letter is presented as a Letter of Certification or Letter of Validation, all dependent on the final score of the conducted assessment. The HITRUST certification has a duration of two years, with interim testing finished within a year.��Because of the increased number of controls, it takes more time and significantly greater resources to complete.

Why 911�Թ� Chose HITRUST Certification
Given the volume of ePHI 911�Թ� stores and processes as part of our daily operations, it was clear that HITRUST certification would best serve our customers’ needs, and we made significant investments in infrastructure, processes, and personnel to achieve it. With five times the controls of SOC 2, achieving HITRUST Risk-based, 2-year (r2) Certification assures our clients that we are using the highest security standards to safeguard their sensitive data from ongoing digital threats facing the healthcare and insurance industries.

The post HITRUST vs. SOC 2 – Why 911�Թ� Chose HITRUST appeared first on 911�Թ�.

The post Driving a Customer-Centric Culture with the Net Promotor Score (NPS®) appeared first on 911�Թ�.

For a child, FAIL is nothing more than the “First Attempt In Learning.” As her father, it’s my responsibility to help her grow comfortable with failing so she can be the best version of herself.

Likewise, in business, one of the biggest mistakes I see talented people make in their careers is being afraid to fail. The prospect of failing is so intimidating, they pursue goals they are guaranteed to achieve rather than aim for more ambitious outcomes they could miss. They are so motivated to avoid error, they shortchange themselves and their colleagues, sacrificing creativity and ingenuity for the safety of the status quo.

To make any decision is to take a risk. Some percentage of our decisions will fail. According to JP Morgan’s Chief Marketing Officer, , “If you’re not failing, then you’re not learning.”

One of the best ways people can get comfortable making fast decisions is to focus on “two-way door” decisions making, rather than “one-way door” decision making. Jeff Wilke, Senior Vice President of Consumer Business at Amazon, does a great job the critical difference between these two: “A one-way door is a place with a decision if you walk through, and if you don’t like what you see on the other side, you can’t get back. You can’t get back to the initial state. A two-way door, you can walk through and can see what you find, and if you don’t like it, you can walk right back through the door and return to the state you had before.”

Two-way door decisions are reversible and therefore require less vetting. As Wilkes says, “Why would we need anything more than the lightest weight approval process for those two-way doors?” What applies for Amazon as an organization applies to people as well. Why worry too much if you can walk it back?

As a CEO, I encourage my employees to make two-way door decisions. This may take the form of releasing a software enhancement that can be rolled back, or piloting a program within a single department before implementing company-wide.

One-way door decisions require more thought and buy-in since they cannot be undone. Both decision types have the potential to yield great results, but one-way decisions risk greater repercussions if they are wrong and take greater care and vetting.

If fear of failure is hindering your organization’s ability to innovate or your personal ability to take risk in your life, consider using the concept of two-way door decision making. It is a safe, simple, smart way to open up your employees or yourself to the risk of failure, and, more importantly��– the risk of success.

The post Falling Through Two-Way Doors – Empowering Employees to Embrace Risk appeared first on 911�Թ�.

This article forced me to rethink my definition of authenticity.

The concept is pretty simple; the advice to “just be yourself” isn’t always the most beneficial. Being your true “inner self” implies that who you are is static or “fixed” and cannot be evolved. ��This is never true; we are all learning and constantly evolving as time goes on. ��Authenticity is created by trying to evolve your inner self to be more like the image of yourself in which you try to project. ��Rather than changing from the inside out, you bring the outside in.

Imagine the opposite; if we were all perfectly honest about our inner-most thoughts.

A decade ago, the author A. J. Jacobs spent a few weeks trying to be totally authentic and transparent. He informed a friend’s 5-year-old daughter that the beetle in her hands was not napping but dead. He told his in-laws that their conversation was boring.

It is safe to say that we shouldn’t always share exactly what is on our minds all the time.

The concept of self-monitoring��is what drives behavior. If you’re a high self-monitor then you’re constantly scanning your environment for social cues and adjusting accordingly. A high self-monitor tends to hate social awkwardness and desperately wants to avoid offending anyone. ��On the other hand, if you’re a low self-monitor then you’re guided more by your inner states, regardless of your circumstances.

Low self-monitoring people think high self-monitors are phonies, and high self-monitoring people tend to think low self-monitors are jerks.

There is a time and a place for more inner openness. ��Research suggests that low self-monitors have happier marriages and a lower rate of divorce; trust and a genuine connection are needed.

Both in work and in the rest of our lives, it is usually the opposite. ��High self-monitors advance faster and earn higher status, in part because they’re more concerned about their reputations. These high self-monitors spend more time finding out what others need and helping them than low self-monitors, therefore, their actions are not phony or fraudulent to others.

The next time someone says, “just be yourself,” feel free to��be cautious. Not everyone wants to hear everything that’s in your head; they just want you to live up to what comes out of your mouth.

The post Rethinking “Just Be Yourself” Advice appeared first on 911�Թ�.

Emma defines happiness as a state of heightened positive emotion that “increases our emotional and social intelligence, boosts our productivity, and heightens our influence over peers and colleagues.”

In his Inc. magazine column, Peter Economy put together a great summary of Emma’s seven scientifically proven ways to build your happiness, and consequently increase your success. I have excerpted these below, along with a few of my own observations:

1.�� Live (or work) in the moment.

Instead of always thinking about what’s next on your to-do list, focus on the task or conversation at hand. You will become not only more productive but also more charismatic because you will be��more��present with your peers.

2.�� Tap into your resilience.

Do not live in stress.�� Work on your ability to handle adversity without it draining you.�� To do so, you need to ��You will naturally reduce stress and thrive in the face of difficulties and challenges.��

3.�� Manage your energy.

Instead of engaging in states of mind that exhaust you, learn to manage your stamina by remaining calm and centered. You’ll be able to save precious mental energy for the tasks that need it most.�� If you think about it, a situation is the same whether you are emotional or objective.�� Being objective allows you to deal with more situations without getting exhausted.

4.�� Do nothing.

Make time for .�� You will become more creative and innovative and will be more likely to come up with breakthrough ideas.�� I have learned this over the years.�� Whitespace (do nothing time) is critical for breakthrough moments. ��I schedule moments of clarity for thinking. ��I have also found my energy increases and my stress reduces if I spend a little time each day doing something mindless.�� A fun tv show, listening to music, reading a non-business book, or time with friends can clear my mind and recharge my battery��in a short period of time.

5.�� Be good to yourself.

Instead of being self-critical, be compassionate with yourself. You will improve your ability to excel in the face of challenge and be more likely to learn from mistakes.

6.�� Step outside your comfort zone.

I am a huge believer that people should always be “be a little uncomfortable” in their jobs.�� Otherwise, they are not pushing themselves or expanding their abilities.�� We tend to think we’re good at only certain things, and we play it safe when we should be taking risks. Understand that your brain is built to learn new things — that’s how we attain new skills and expertise.

7.�� Show compassion to others.

Instead of focusing on yourself,��, and maintain supportive relationships with your co-workers, boss, and employees. You will dramatically increase the loyalty and commitment of your colleagues and employees, thereby improving productivity, performance, and influence.

The post Happiness AND Success appeared first on 911�Թ�.

One of his observations that jumped out was “knowledge is not enough to change behavior.” ��If it were, NOBODY would smoke, eat dessert, or do drugs. ��Pretty obvious, but quite profound if you think about it.

You need to modify behaviors to achieve different results.

In business, this concept should be incorporated into training and team development methodologies. ��A leader or trainer cannot simply “tell” the team what needs to be done. ��The most effective team-building comes from helping people modify behaviors��to improve success and performance. ��As individual employees, we also need to be aware of this, and mentally force ourselves to not just know the right thing to do, but��modify our��behavior to best��practices. Only through reinforcement will behaviors become ingrained, and a part of an organization’s individual and team DNA.

While this concept can apply to any job, it is equally applicable to any individual life choice.

For instance, in my own personal life, I have the knowledge that I should��lose weight and that to do so, I need to ingest less calories. ��Sometimes, I eat and drink��less. ��Other times (usually around the holidays or vacation), I let it go and lose much of the gains I made. ��I need to consciously modify my behaviors to sustain and achieve my goals. ��The hole I created is self-inflicted, and getting out of the situation is way harder than maintaining it once I have achieved a good state. Still, the change in behavior is on me.

Knowledge is not enough. Developing systems that help us hold ourselves and others accountable for modifying behaviors is the key to achieving both personal and organizational success.

The post Knowledge is Not Enough to Change Behavior appeared first on 911�Թ�.

It is tough for me. My lifestyle is inconsistent. I eat out and entertain A LOT. Last week, I had dinners planned for six nights in a row, not to mention business lunches. It takes a toll on the body. Still, I go up and down, and I need to figure out a way to maintain the same weight. I have young kids. I want to be around to know my grandchildren.

I jumped on the scale today and found that I dropped a good amount of weight yesterday. I have felt great all day. I’m motivated not to eat too much, and I’m dying to find the time to work out tonight after dinner.

Last weigh-in, I realized my weight had gone up. I was discouraged and drained for a while afterwards. I had no drive to work out or eat less.

It dawned on me how motivating success is. Hitting your goals and targets is self-fulfilling. You want to hit them again and again, and are excited when you do. Failure has the opposite effect. It is draining and demotivating. Failure begets more failure.

The key is, simply put, to START. The most successful people I know make it a part of their DNA to hit their metrics and goals. If they have a deadline, they make it—no excuses. Over time, they crave and expect that success, and achieving it becomes easier and easier. And they exude the energy and confidence that only comes with success.

The post The Joy of Hitting the Numbers appeared first on 911�Թ�.

Such a simple statement, and yet so profound.

People accomplish amazing things every day. Those people believe they can do it. Others make excuses, and explain all the tough reasons why they are unable to accomplish something. Guess what? They do not accomplish those things. They were right.

I get triggered when I hear the reasons why something “cannot” be done. Stop thinking about “why your team cannot do something,” and change it to “we will accomplish this, we just need to figure out how.” It is amazing how a simple change in attitude can have a tremendous impact on outcomes in both your work and life.

The post Whether You Believe You Can or You Can’t — You Are Right appeared first on 911�Թ�.

Lessons from Tim Minchin’s Speech:

1. You do NOT have to have a giant DREAM. Instead, have passionate dedication to short-term goals. If you focus too far ahead, you won’t see the shiny thing out of the side of your eye.
2. Do NOT seek happiness. If you think about it too much, it goes away. Keep busy and aim to make someone else happy.
3. It’s ALL luck. You are lucky to be here, to have your background, your DNA, etc.�� Don’t take yourself too seriously.
4. Exercise. Take care of your body. We are living longer.�� You are going to need it.
5. Be HARD on YOUR OWN opinions and beliefs. Be intellectually rigorous.
6. Be an AMAZING TEACHER in all aspect of your life. Share your ideas, rejoice in what you love, and SPRAY IT.
7. Define yourself by what you LOVE, and not what you dislike.
8. RESPECT people with less power than you.
9. DON’T RUSH. Don’t PANIC. You do not need to know what you are going to do with your life yet.

Finally, leave it to humans to think that life has a purpose. There is one sensible thing to do with this empty existence: FILL IT. LEARN as much as you can about as much as you can. Take PRIDE in whatever you are doing. SHARE ideas. BE enthusiastic, “It’s an incredibly exciting, wonderfully meaningless life of yours.”

The summary loses a lot of the finer points of his message, so enjoy his sometime.

The post Life Lessons from an Australian Comedian appeared first on 911�Թ�.

The post Your Internal Clock – Morning Person or Night Owl? appeared first on 911�Թ�.