Committee document
Procurement memo: approving a migration vendor without SOC 2
A memo for procurement and security when the preferred vendor holds no SOC 2 report. It sets out what a SOC 2 report would cover, what applies instead when the software runs inside your controls, and the conditions to set. Counsel should read the certification lines.
The facts
The facts
Novuz holds no SOC 2 or ISO certification today; a SOC 2 Type I is planned. The software runs as a Docker container or VM inside our environment, under our identity provider, logging and network controls. No outbound connection is required.
What SOC 2 covers
What a SOC 2 report would tell us
A SOC 2 report describes the controls a vendor operates over systems that hold or process customer data. Here the systems that hold our code and data are our own. Our controls, and our own audits of them, apply to the Novuz workload as to any software we run.
Collect instead
What to collect instead
- The architecture document and data flow diagram, showing what crosses the network boundary (nothing is required to).
- The deployment guide for Docker and VM.
- Completed standard security questionnaires.
- The vendor’s statement of which certifications are held now and which are planned, with dates.
- If a hosted model is used for edge cases: our own agreement with that model provider, and the list of what it sees.
Conditions
Conditions to set in the approval
- Deploy inside our environment, with no outbound connection, or only those security approves.
- Code shared for an assessment goes under NDA and is deleted on a stated date, or the discovery container runs inside our network instead.
- Vendor staff access only through our identity provider, revocable at any time.
- The vendor notifies us when its SOC 2 Type I report is issued.
- Escrow and ownership clauses reviewed by counsel before signature.
Recommendation
Recommendation format
We recommend approving [vendor] for [scope] under the conditions above, because the software runs inside our controls and no code or data is held by the vendor. We will review the approval when [the SOC 2 report is issued, or 12 months].
Below the document
Where to read next
Print or save this page as the document. Every figure in it is one the reader can check on the linked pages.
FAQ
Frequently asked questions
Can procurement approve a vendor without SOC 2?
Often, when the vendor’s software runs inside your own controls and the vendor holds none of your code or data. Collect the architecture document, the data flow diagram and questionnaire answers instead, and set conditions in the approval. Counsel and security make the final call.
Is Novuz SOC 2 certified?
Not today. Novuz holds no SOC 2 or ISO certification; SOC 2 Type I is planned. The software runs inside your existing security boundary, so your controls apply to it.
Last reviewed:
Find out what your logic debt is costing you.
Every object counted, lineage, dead code and a fixed price in three business days. $3,000, credited.
Not sure which door? The scorecard takes ten minutes and tells you.