FRSecure

What was the scope of their involvement?

Security auditing is one of the largest aspects of FRSecure’s work with us. It assures our customers that we are as secure as we claim to be and they can trust us with their data. Every two years, they do a comprehensive two-day audit of administrative, technical and physical security systems. I provide them with documentation of our security procedures, as well as other evidence I can offer to prove we’re doing everything we can to protect our customers’ internal data. 

After they’ve completed the audit, they deliver a graded report with recommendations on what we can do to improve. That recommendation is extremely important to us because it helps us prioritize the issues that need to be addressed.

Beyond audits, FRSecure has advised on a lot of our security policies and procedures. They’ve designed some of the security awareness and incident response training we send out to our employees. They’ve also come on site and given live training to our employees. 

Another large part of our partnership is their assistance on our payment card industry (PCI) certification. To collect credit card data, our credit card data security system has to be audited and pass the PCI certification. PCI council allowed FRSecure to be our PCI auditor which has been greatly helpful because they know our system so well. With their recommendations and assistance, we’ve been able to pass our PCI certification for the last three years. 

What is the team composition? 

In the early days of our partnership, we worked closely with FRSecure’s CEO and founder, Evan Francen. As the company grew and Evan took on more responsibilities, we began working with our own security advisor and project manager from their team. We also work with a variety of additional people from their team depending on the project. Currently, we’re working closely with about five people from their team.

How did you come to work with FRSecure?

One of the sales reps cold-called us to offer their services. After doing a bit of research on them and meeting with Evan, we decided to move forward with them.

What is the status of this engagement?

We began working with them in 2012. Currently, we work with them on a monthly retainer basis.

What was the scope of their involvement?

They currently only do penetration testing for us, but that could change at any moment with our requirements. The actual testing lasted about a week. Afterwards, they gave us a comprehensive report with suggestions on how to further protect our data. We're definitely open to utilizing them for additional services in future.

What is the team composition?

I communicated with a main point of contact and worked directly with one tester as well. However, two or three testers worked on the project.

How did you come to work with FRSecure?

We considered several companies, but FRSecure was recommended to us by our IT vendor. Considering the cost and a couple of other factors, we felt they were the best fit for our company.

How much have you invested with them?

We’ve spent $4,500.

What is the status of this engagement?

We started working with them in June 2017 and the relationship is ongoing.

What was the scope of their involvement?

Everything’s been related to a SOC 2 audit. We’ve done two to three different engagements with them related to that. A lot of firms are requiring their partners and vendors to go through a SOC 2 audit. It basically makes sure we have the processes and procedures to minimize risks of a cybersecurity breach. We hold a lot of their data, and they want to ensure we’re secure. That’s where FRSecure came in.

A SOC 2 audit entails getting all your systems up to snuff, and then an auditor comes in to confirm we’re done it right. We’re at the stage right now where FRSecure is helping us get ready for this audit. We’ll have the auditor come in very soon, and we’re hoping we pass. We’re setting up lots and lots of policies. For example, if you have a new employee come in, we have a policy that defines the steps IT needs to take.

They look at our server to make sure it has all the up-to-date stuff, so the client can’t get hit. We have to make sure we lock our file rooms and don’t leave stuff at our desks, all the various things that would increase the chances of Social Security numbers being released to the wrong people. It’s the whole process; setting up all the policies, and then other processes, and working with our internal IT guy to make sure we’re doing the most up-to-date stuff.

We had one on-site meeting, but otherwise, it’s all done remotely. It’s nice to have that option. FRSecure delivers reports and action items as they go along. They’ve given us samples to work with, so we start with those and modify them to meet our firm’s specifics. They’ve been very knowledgeable, and they’ve had a lot of good tools that allow us to work with what they’ve given us and to update.

How did you come to work with FRSecure?

I looked up local auditors who do SOC 2 audits, and they’re the ones who actually referred us to FRSecure. The auditors had worked with them many times and said it’s gone well. They’re a smaller company close to us, so it just made a lot of sense. They were the only company we interviewed.

What is the status of this engagement?

We’ve been working together for almost a year. It’s been taking us a long time, and I’m still not done. That’s not due to anything FRSecure has done, we’re just busy at work. I have to update a few more policies and get that ready for the auditor.

What was the scope of their involvement?

They’ve done 3 audits for me—a social engineering audit and 2 IT audits for 2 different years. On the social engineering side, we were doing an internal phishing and calling scam to see how many of our employees would click on the link or answer the phone call by sharing some private information. The IT audit addressed 4 categories: penetration testing, vulnerability assessments, IT general controls and governance, and physical security.

The reports that they delivered at the conclusion of these audits resulted in action items, especially for the first year. The second audit report identified new threats. That was my expectation because we had satisfied the original items, as verified through this second audit. These new steps were designed to take us to the next level in the maturity model for security.

For both years, different analysts came in, but I was still able to ask the analyst questions. I had a project manager that was my single point of contact for each year, which helped make it more efficient on my side.

How did you come to work with FRSecure?

At the time, I had sent out an RFP. Five companies responded, including FRSecure. The deciding factors were the clarity and accuracy of their response to the RFP, experience level, presentation of documentation, and price point. FRSecure had the best answers and options. I did the social engineering audit almost as a test for their company to see how they handle even just a regular IT project. It was a good small scope to begin our relationship with.

How much have you invested with FRSecure?

For both years, we spent between $17,000–$20,000.

What is the status of this engagement?

I originally sent the RFP in 2015. The social engineering audit was done within the first year, prior to the IT audits. Both IT audits were done over 2 consecutive years. We added the FFIEC [Federal Financial Institutions Examination Council] portion to the last IT audit.