Rockset Is Now SOC 2 Sort II Compliant


The Rockset workforce is proud to announce that now we have been accredited as SOC 2 Sort II compliant. Our prospects entrust Rockset with their knowledge, and now they’ve rigorous, impartial assurance that we shield it by following safety greatest practices.

What’s SOC 2 Sort II?

SOC is considered one of a number of System and Group Controls audits developed by the American Institute of CPAs (AICPA), the world’s largest member affiliation of accountants. Every SOC take a look at evaluates the validity of a enterprise or service supplier’s safety controls and the operational effectiveness of their methods.

SOC exams differ considerably, nevertheless. In accordance with Forbes journal, SOC 2 “is probably the most thorough and extensively valued of the three SOC reviews,” and the Sort II accreditation requires “a much more in-depth assessment” of our knowledge safety protocols than the Sort I. And MPA (Mortgage Skilled America) journal calls SOC 2 Sort II “among the many most coveted and arduous to acquire information-security certifications.”

By reaching SOC 2 Sort II compliance, Rockset was in a position to display that our data safety and knowledge insurance policies, procedures, and practices will shield our buyer’s knowledge. It reveals that we’ve taken the correct steps to make sure that knowledge is safe.

Scope

What was included within the audit? At a excessive stage, Rockset was assessed on the themes of Safety, Confidentiality and Availability for the technical infrastructure and firm processes required to supply and assist our SaaS service.

  • Change administration:
    Updates to the infrastructure, utility, UI and API are linked to documented necessities, and merging of latest code requires peer assessment.
  • Secrets and techniques administration:
    Encryption keys, passwords and different secrets and techniques are saved securely in access-controlled vaults with permission granted solely on a necessity foundation.
  • Metrics-based alerting:
    Operational efficiency knowledge feeds into real-time dashboards and alerting methods.
  • Safety monitoring:
    Alerts are despatched to the safety workforce on a spread of occasions, together with uncommon outbound connections, anomalous authentication occasions, and suspicious server processes.
  • Hiring, onboarding and off-boarding processes:
    The Folks Group ensures the abilities and skills of latest hires match the necessities of every open place, conducts screenings through the hiring course of, requests applicable accesses primarily based on position, and ensure these accesses are eliminated when personnel depart the corporate.
  • Entry controls:
    Entry is granted to firm assets primarily based on position, and are reviewed on an ongoing foundation.
  • Vulnerability administration:
    Rockset conducts common Third-party penetration exams and receives vulnerability reviews from impartial safety researchers on an ongoing foundation. Safety bugs are remediated by precedence and tracked to decision.

What Does This Imply for You?

For enterprises seeking to deliver on third-party service suppliers, Rockset’s SOC 2 Sort II compliance signifies a stage of course of maturity that minimizes danger and focuses on the safety of buyer knowledge.

Rockset’s SOC 2 Sort II compliance implies that our danger mitigation contains the event of deliberate insurance policies, procedures, communications and various processing options to answer and get better from any enterprise disruption. With this dedication, Rockset is ready to make sure the impression of any doable danger to our prospects is minimized.

If you wish to be taught extra about what SOC 2 Sort II accreditation means for you, take a look at this complete checklist from InfoSecurity Journal.

Our Dedication to Your Knowledge’s Safety and Privateness

Earlier than we even based Rockset, we knew that safety and compliance can be entrance and middle when it got here to constructing our knowledge observability platform structure. In truth, safety runs in our DNA. A number of of us hail from cybersecurity suppliers like Palo Alto Networks and/or have cybersecurity certifications.

What’s Subsequent?

With SOC 2 Sort II, there isn’t any “resting in your laurels.” It’s an ongoing dedication. We’re consistently striving to exceed the requirements, and frequently enhance our safety posture.

You probably have questions on Rockset’s SOC 2 Sort II compliance, attain out to our workforce at safety@rockset.com. To be taught extra about Rockset’s Safety Design, please go to: https://rockset.com/whitepapers/rockset-security-design


About Martin Englund

Martin Englund is the Info Safety Officer at Rockset and member of the Web site Reliability Engineering workforce. He holds a CISSP certification and lives by the motto “The query is not in the event you’re paranoid, it’s in case you are paranoid sufficient”.

Martin has over twenty 5 years of expertise in safety and automation, and has contributed to quite a few open supply DevOps instruments. Previous to his present position, he has labored as Web site Reliability Engineer at Palo Alto Networks and Manufacturing Engineer at Fb.

Earlier than switching fields to Web site Reliability Engineering, he was a Principal Safety Engineer at Solar Microsystems, the place he spent over fifteen years in numerous safety roles all through the corporate, co-authored the Solaris Safety Necessities guide, and authored a safety patent.