Customer story · Transportation & logistics technology · 2022 to 2025
From no security program to Type II across a portfolio.
A transit technology portfolio that powers more than 100 million rides a year, with a diverse set of software companies under one roof, set out in 2022 to strengthen its trust posture, starting with two subsidiaries that had no formal security program at all.
Context
What the work had to do.
The engagement scoped SOC 2 readiness across eight transportation and logistics software companies. The subsidiaries had no information security frameworks, no risk management process, and no IT service management for change, continuity or incident handling, on an aggressive timeline to reach Type I and then scale.
SOC 2 readiness across eight transportation and logistics software companies
No formal security programs at the subsidiaries; governance had to be repeatable, not bespoke
Type I first, then an expansion path to Type II across the portfolio
Strategy and execution
What 3HUE did.
Risk assessment and control baseline
A comprehensive risk assessment established one control baseline the whole portfolio could inherit.
ITSM engineered to the controls
Change, continuity and incident management processes were built so operational workflows produced SOC 2 evidence as a by-product.
Managed governance model
Information security, risk management, vendor compliance and cyber incident response run as one managed program, with audit readiness guided through Type I and expansion planning.
Outcomes
What changed.
SOC 2 Type I across Security, Confidentiality and Availability for the first two subsidiaries, in 2023, with no audit findings.
By the end of 2024 the portfolio held SOC 2 Type II across six companies, four of which bypassed Type I entirely.
Formal IT and security processes, continuous risk management and vendor oversight embedded into operations rather than bolted on for the audit.
- Holistic risk and control posture assessment
- SOC 2 readiness
- IT service management process engineering
- Managed security and GRC program
- Unified security and risk framework
- ITIL and COBIT practices
- NIST and ISACA risk management practices
If this sounds like you
The lane that fits.
A regulated or multi-entity company that needs one program across several units: the Managed lane, with Client Vision carrying the evidence for every entity.
Outcomes, on the record.
Book fifteen minutes, or send an inquiry. We respond within one business day.