Cybersecurity Case Study
Strongpoint’s Path to SOC 2 Compliance
Protecting our people, our data, and the clients who trust us with their retirement future.
Building a culture of security.
In the retirement services industry, the data we handle is among the most sensitive there is: Social Security numbers, financial records, and personal information for thousands of plan participants. Protecting that data isn’t just a regulatory requirement. It’s a fundamental responsibility to every client and participant who trusts us with their information. That’s why Strongpoint is making a significant, organization-wide investment in cybersecurity, with a clear goal:
Achieving SOC 2 compliance.
Context
What is SOC 2 compliance?
SOC 2 (System and Organization Controls 2) is a voluntary, CPA-audited compliance standard for service organizations. It ensures that a company manages sensitive customer data responsibly, based on five core trust criteria: security, availability, processing integrity, confidentiality, and privacy. Strongpoint is beginning with the Security criterion, which is the required foundation of any SOC 2 audit, and will evaluate additional criteria in the year ahead.
For companies like Strongpoint and our partners, which administer retirement plans for thousands of businesses across the country, SOC 2 compliance is a powerful demonstration of trustworthiness to clients, partners, and regulators alike. Strongpoint’s path to SOC 2 compliance is built on three pillars:
Education & Shared Responsibility: Cybersecurity is not just an IT issue: it’s everyone’s responsibility. Mandatory training on phishing awareness and data security is rolling out across the Strongpoint organization, building a culture where every team member understands their role in protecting the firm and its clients. Our goal is to make cybersecurity a shared responsibility, not just a checkbox.
A Secure Tech Stack: Strongpoint is investing in technology infrastructure upgrades for new partners joining the network, ensuring that every partner firm onboards onto a secure, modern platform. This includes a thorough review of systems, integrations, and data flows to close gaps before they become vulnerabilities.
Website & Systems Refreshes: As Strongpoint’s digital presence grows, so does our commitment to keeping it secure. Website refreshes are underway across the network to align with modern security standards, creating a more professional experience for clients and a more defensible posture for the organization.
The Benefits:
SOC 2 compliance is more than a certification. It’s a statement about who we are: a partnership of TPAs that takes the responsibility of managing retirement data seriously, and that earns the trust of our clients not just through expertise, but also through integrity.
→ Three Pillars: Education, Secure Tech Stack, System Updates
→ Security First: Evaluating controls, processes, and procedures against SOC 2 Security criterion
→ 100% mandatory training across the organization
Placeholder: integrations headline goes here.
Endpoint Detection & Response (EDR): Monitors devices in real time to detect and stop threats like malware and ransomware before they spread.
Threat Intelligence: Tracks adversary groups globally and provides intelligence on attack techniques, helping organizations anticipate threats rather than just react to them.
Identity Protection: Detects credential-based attacks and stops unauthorized access attempts across an organization.
Cloud Security: Protects cloud workloads, containers, and infrastructure from misconfigurations and attacks.
Security Operations Platform: Integrates with an Strongpoint’s existing security tools to unify visibility across the entire environment in one place.
Threat Detection & Response: Automates detection and investigation of threats, reducing the time it takes to identify and respond to incidents.
AI & Automation: Uses AI to automate repetitive analyst tasks, aiming to reduce alert fatigue and speed up response times.
“SOC 2 isn’t just a certification we’re working toward — it’s a reflection of how seriously we take our responsibility to the people whose retirement data we manage every day.”
Craig Schoeberle, VP of Information Technology • Strongpoint