SOC 2 Overview
A Service Organization Controls (SOC) 2 audit examines the controls an organization has in place to protect and secure its system, or services used by customers or partners. An organizationā€™s security is assessed based on the requirements within a SOC 2 examination, known as the Trust Services Criteria (TSC). The is the governing body of the SOC framework and they set the U.S. standards that auditors follow for SOC 2 examinations.

The report assesses if a companyā€™s controls are appropriately designed and working under the five TSC. They include:

• Security
• Availability
• Processing Integrity
• Confidentiality
• Privacy

Security is the only TSC that must be met in the SOC 2 report. The other four are optional but are usually added depending on the type of service(s) that an organization offers. This versatility is essential because SOC 2 reports are meant for use across all industries.Ā No matter the nature of the business, the focus is on securing digital information.

There areĀ , Type 1 and Type 2.

• SOC 2 Type 1Ā evaluates an organizationā€™s cybersecurity controls at a single point in time. The goal is to determine whether the internal controls put in place to safeguard customer data are sufficient and designed correctly. Do they fulfill the required TSC? Type 1 audits and reports can be completed in a matter of weeks.
• SOC 2 Type 2 examines how well a service organization’s system and controls perform over a period of time (typically 3-12 months). What is their operating effectiveness? Do they function as intended? Type 2 audits can take 12 months to complete and are costlier than Type 1 audits.

How Does SOC 1 Differ From SOC 2?
SOC 1 Type 2 is an audit 911³Ō¹Ļ undergoes annually. It focuses on financial controls instead of data security. If a company uses a third-party service provider to perform crucial financial reporting processes (e.g., an outsourced payroll management system or a revenue reporting platform), the company will likely ask those service providers for a SOC 1 report. As a bill review provider conducting payment processing services on behalf of clients, 911³Ō¹Ļ frequently provides our SOC 1 report to customers.

Like SOC 2, there are two levels of SOC 1 audits:

• SOC 1 Type 1 evaluates the fairness of managementā€™s description of the service organizationā€™s system and the suitability of the design of the controls to achieve the related control objectives included in the description, as of a specified date.
• SOC 1 Type 2 evaluates the fairness of managementā€™s description of the service organizationā€™s system and the suitability of the designĀ and operating effectivenessĀ of the controls to achieve the related control objectives included in the description throughout a specified period.Ā Type 2 audits are much more robust than Type 1. Type 2 audits actually evaluate if a company is doing what it says over a period of time.

HITRUST Overview
Founded in 2007, the, orĀ , is a not-for-profit organization advocating programs that protect sensitive information and manage information risk.

While the HITRUST Common Security Framework (CSF) is designed for all industries,Ģżit is closely associated with the healthcare industryā€™s challenges, such as the numerous applications of controls specific to healthcare (e.g., ). Overall, the HITRUST framework is used as a guide by organizations that deal withĀ or ePHI. TheĀ Ā was a response to the need to have more consistency in certifications. The aim is to have a standard regulation and risk management framework.

HITRUST CSF consolidated the varying requirements from ,Ģż, , , and and checks for the following:

• The presence of clearly defined procedures and policies
• Capability testing to prove its implementation
• Demonstration of a companyā€™s ability to measure and manage these controls

Compliance with this frameworkĀ ensures the protection of sensitive ePHI.Ā This is why meeting the HITRUST CSF requirements is vital to stay on top of all relevant regulations and standards.

Both SOC 2 and HITRUST reports revolve around the protection of sensitive personal data.Ā One main difference is that SOC 2 is an attestation report, while HITRUST is a certification.

Attestation Report (SOC 2)
An attestation report discusses the confirmation of management that the information in the report is accurate. An independent author will then confirm this report with the help of an opinion. The opinion in the SOC 2 report can be clean, unqualified, qualified, or adverse. Qualified means that the testing cannot confirm that at least one objective has been identified by management. Adverse implies that the testing has failed to verify most of the purposes outlined by management. Even though it may seem it has an asterisk beside it, a qualified report is still reliable. But the company must follow up on it to prove that remediation steps have been undertaken to address any issues raised in the qualified report. SOC 2 reports are completed yearly and may go on from one to three months from completion to report delivery. This depends on how promptly the SOC 2 client can provide documentation and the evidence needed for testing.

Certification Report (HITRUST)
The HITRUST report differs from SOC 2 because it comes with a certification. It has more details peppered in with the reportĀ with five times more controls as it incorporates requirements from numerous standards within the HITRUST CSF. Within the HITRUST report, the organizationā€™s management needs to submit a Letter of Representation instead of the management assertion inscribed within the SOC 2 report. This Letter of Representation is still collected within the SOC 2 report but is not included in the final report. The opinion in the HITRUST Certification letter is presented as a Letter of Certification or Letter of Validation, all dependent on the final score of the conducted assessment. The HITRUST certification has a duration of two years, with interim testing finished within a year.Ā Because of the increased number of controls, it takes more time and significantly greater resources to complete.

Why 911³Ō¹Ļ Chose HITRUST Certification
Given the volume of ePHI 911³Ō¹Ļ stores and processes as part of our daily operations, it was clear that HITRUST certification would best serve our customersā€™ needs, and we made significant investments in infrastructure, processes, and personnel to achieve it. With five times the controls of SOC 2, achieving HITRUST Risk-based, 2-year (r2) Certification assures our clients that we are using the highest security standards to safeguard their sensitive data from ongoing digital threats facing the healthcare and insurance industries.

The post HITRUST vs. SOC 2 – Why 911³Ō¹Ļ Chose HITRUST appeared first on 911³Ō¹Ļ.

The post Driving a Customer-Centric Culture with the Net Promotor Score (NPSĀ®) appeared first on 911³Ō¹Ļ.

• Be responsive. Your customersā€™ urgency must become your urgency.
• Be consultative. Gently challenge, make informed suggestions and provide options.
• Keep it simple. Skip the jargon and sell the results.
• Take an interest in the person; make it personal.
• Keep your customer informed; nobody likes to be in the dark.
• Be willing to go the extra mile; give customers more than they expect.
• Follow up to check the customerā€™s level of satisfaction … itā€™s never over.

Bringing value to your daily customer interactions is the key to creating lasting business relationships.

The post Creating Exceptional Customer Relationships ā€“ Itā€™s a Must appeared first on 911³Ō¹Ļ.

I often talk and focus internally on the simplicity of the experience with our products.  It should appear so effortless to our clients that the result is sheer elegance.  This is a beautiful word to describe world class products and services.

The post Elegance appeared first on 911³Ō¹Ļ.

What I notice, in short, is the mistake businesses make too often. Most people develop products and services as if they are the hero. If this were Star Wars, they want to be Luke Skywalker saving the world.  Service providers should not strive to be the hero.  We are not the Luke Skywalker of our clients’ story.  We are the mentor (Obi-Wan Kenobi) and our job is make sure our client is the hero (Luke Skywalker).

The post Reframing Your Communication appeared first on 911³Ō¹Ļ.

Every amazing invention, company or experience is based on people that focused on every last detail. Good enough is not good enough. Focusing on the small stuff sets the tone for tolerating nothing but exceptional.

When New York was a crime ridden, dangerous place to live, Giuliani decided to sweat the small stuff with crackdowns on relatively minor offenses such as graffiti, turnstile jumping, and aggressive squeegee men. The principle was that this would send a message that order would be maintained and the city would be “cleaned up.”Ā  It worked; the city’s crime rate plummeted.

When eating at a fine restaurant like Chicago Cut across the street from our corporate offices, it all comes down to the details.Ā  The best run restaurants will do little detailed things like alternate a dark napkin (for people wearing dark pants/skirt) or a light napkin (for people with light pants/skirt) so no lint appears contrasting to the diners’ pants or skirt.

One of my best examples of a detailed-driven experience was at a restaurant in Istanbul. The staff constantly rotated my white wine into chilled glasses to keep it cold while eating outdoors in the blistering heat.Ā  Neither the colored napkins nor the chilled glasses really make a major difference, but they do create an “experience.”Ā  They show the level of detail a facility is focusing on in order to be exceptional.Ā  I have never had a bad experience at a place that focuses on the granular level of detail. When a team gets down to the micro details the big stuff is always taken care of.

The post Do Sweat the Small Stuff appeared first on 911³Ō¹Ļ.

Anyone that follows boxing or football has heard the expression power thrills, but speed kills. Think about it. Mass and velocity together determine the energy behind an object. Get hit by a car going one mile per hour, not so bad. Speed it up, and it is a different story. The same holds true in the business world.

McDonald’s and other “fast” food may not be considered the “best” food, but they made it faster and became a global powerhouse (serving the convenience factor).

Jiffy Lube may not be the most robust car care, but it sure is easier than leaving the car at the dealer (again, serving the convenience factor).

Google has all but replaced the encyclopedia and Yellow Pages because it is “instant” (speed).

It’s the exact same in our world. Speed is critical to a customers’ satisfaction in almost everything we do for them. Why does this matter so much?

The post The Power of Speed appeared first on 911³Ō¹Ļ.

His holding firm owns many companies, including a sign making company (Dunkin Donuts is a client). He was talking about his sales staff going straight for the sale, focusing on their signs’  benefits, quality, etc.  Meanwhile, the CEO keeps preaching “listen to the client first.”

Sometimes, the buyer already understands your value, but they can’t afford the full price that year. Sometimes, capital purchases go into a capital budget and that’s approved by another department, or the capital expense budget is maxed out for the year. What if they could lease the sign?  Then the expense goes into an operating budget and that portion of the budget has budget room, or does not need approval.

The sign company does not get all the cash up front, but they get ongoing revenue. That model makes them more money over time. So it’s a win/win for the sign company and the client. His team just had to listen to the clientsā€™ problems.

To do this properly, you must design configurable systems and processes that can morph to meet clients’ needs in a way that you can be successful also.  Really, solving a client’s problem is not the hard part most of the time.  The hard part is truly knowing what problem a client is trying to solve.  How do you get there? By listening, really listening to a client’s needs and constraints. It’s in the listening, where the real skill in sales and account management lies.

The post Shhhh — Just Listen to Your Customers appeared first on 911³Ō¹Ļ.

California is notorious for their high levels of taxes and cost.  They also passed an Internet law and , likely putting a lot of small California vendors out of business.  Over a million high earners have in the last few years to lower tax states.

We all read about .  Why do people think that is happening?  When I was on my honeymoon, I met quite a few business people from around the world.  Three of them said they tried to set up US businesses, but the taxes, regulations and employment laws were too burdensome.  They said China was way easier.  China?  A communist country?  Anyone else think something is really wrong here?

There is a concept called in economics.  The premise is simple.  When the supply of “something to sell” is low and the demand is high, prices rise.  Alternatively, when the supply of “something to sell” is abundant and the demand is low, prices drop. If you raise the price beyond peopleā€™s demand for it, they wonā€™t buy it.
  
Look at the housing market for an example. The market was hot and more people wanted to and could buy homes (easy loans), so housing prices skyrocketed.  When prices got too high, nobody could get loans and more houses were built than people could buy, so prices have been on a steady decline.  Supply and demand.

The Verizon iPhone is another example.  The AT&T iPhone sells out in minutes and is often on backorder because they created demand by being first to market. Verizon over guessed their demand, ordered too many iPhones, did not sell all their supply and now give them away with corporate contracts.

The same economic forces apply to government.  It is much more obvious and rapid when it comes to state regulations.  Companies can move to a new state very easily, especially if they are near a border or are a national company with locations in multiple states.  If regulations or taxes are higher or more difficult in one state versus another, growth is pushed to the state with less expensive regulations.  Let me put it this way.  If it is less expensive to move than to stay, businesses or people will move. 

When governments talk about raising taxes to raise revenue, they never take into account supply and demand.  They assume behavior will stay the same.  What happens in reality is the people and companies that are negatively impacted will adjust behavior or move. The people and companies that stay, have to, because they are smaller or are the ones receiving the benefits, not paying for them.  The net effect is the people funding the government spending leave, cut back or push growth elsewhere; and those taking government spending stay — and then the budgets don’t balance.

Government overspending is incredibly destructive and we as citizens need to make sure that we force them to have a controlled budget and live within that budget at all times.  Otherwise they will always bring us to the brink, wasting our and our children’s future opportunities.  It is simple economics.

The post Supply and Demand – Applies to Governments Too appeared first on 911³Ō¹Ļ.

It’s a fascinating topic that can take a lifetime to master. Many companies desire a ā€œgreat customer experience,ā€ but they really put no effort into learning what makes a great experience.

I’ll argue that a great customer experience is a happy one. The same things that make us happy in life, will work when applied to a customer experience. There are a lot of businesses out there that try their best to make their customer experience a happy one by making their products , trying their best to look after their customers’ by forcing their wants and needs.

I’ll also argue that a company or team of people cannot ā€œfakeā€ who it is for long. Using 911³Ō¹Ļ as an example, I don’t think we can create a consistently amazing (aka “happy”) experience for our customers without a great culture where our employees are “happy.” How are we going to systematize and scale “faking” a happy experience? It isnā€™t even worth figuring out. I would rather have authentically happy employees serving customers to make them authentically happy.

I often study other superstar companies to see what they are doing well that we can learn from and possibly bring into 911³Ō¹Ļ. Zappos is a company I’ve been exposed to and have enjoyed learning about. Why? They seem to be as fanatical about culture and customer experience as I am. This was an online “shoe” company that became HUGE due to their customer experience. Shoes? Online? What could be more boring? How can you stand out from thousands of websites selling shoes?

The CEO of Zappos, Tony Hsieh has made and lost a fortune before Zappos and has discovered it has to be about more than money. He spends a lot of his time focused on employee and customer happiness. When I heard him speak, he outlined the four basic human needs to be happy:

1. Perceived Progress
2. Perceived Control
3. Relatedness
4. Connection to a Larger Vision

This really got me thinking. I spend time, and encourage my managers to spend time, making sure our team and customers are engaged in all 4 levels to ensure a positive happy experience. It takes work to think it through and systematize it throughout a culture, but the long term benefits are worth it.

The post 4 Basic Human Needs for Happiness appeared first on 911³Ō¹Ļ.