Managed Mycroft services for SOC 2, ISO 27001, HIPAA and more

Mycroft's site describes five parts in one platform: audit and compliance, cloud security, application security, device management and third-party risk management. The cloud security part is cloud security posture management (CSPM): it checks your cloud environment on a schedule and returns findings with severity and remediation suggestions. The application security part is dynamic application security testing (DAST): scans run on a schedule or as custom scan jobs, and vulnerabilities are tracked over time. Device management covers a device dashboard, compliance checks, remote lock and remote wipe. Mycroft's license also includes managed detection and response (MDR). A platform finds the issues. Someone still has to read the findings, decide what matters and get them fixed, which is the work our managed service covers.

Our view is that compliance is a byproduct of effective security, so we look for platforms that do real security work and not only evidence collection. Mycroft builds CSPM, DAST, device management and managed detection and response into the same license as the compliance tests, so findings and controls sit in one place. It is also a Canadian company, which matters to many Canadian buyers. Truvo Cyber is a Mycroft distributor and earns a fee on licenses it refers. We also operate Vanta, Drata, Secureframe and Scrut, and the right platform depends on your environment.

Mycroft automates evidence collection and continuous testing for the systems it connects to, and its site describes security experts who help run the audit. People inside your company still decide the audit scope, own the controls, fix failing tests, complete manual controls such as access reviews and vendor reviews, and answer for the program to buyers. Companies with a security lead who has time for that work often operate Mycroft themselves. Where that work falls to the CTO or an engineering lead, companies tend to bring in a Mycroft consultant or a managed service that works for them.

A Mycroft consultant helps a customer get value from the platform: enabling frameworks and integrations, tailoring policies, preparing for the audit and, in a managed service, operating the program afterwards. Truvo Cyber is a cybersecurity consulting firm that operates Mycroft for clients as a monthly managed service, alongside vCISO, penetration testing and security questionnaire work.

Mycroft is the compliance platform. A licensed CPA firm performs the SOC 2 audit and issues the report, working from the evidence in your Mycroft account. Our Mycroft audit services cover the work before and during the audit: a readiness review, closing gaps, coordinating with the audit firm you choose and answering its evidence requests in Mycroft.

The timeline depends on how much of the setup is complete. The Assess phase of our managed Mycroft service ends with a Mycroft health check: each gap, its owner and a date. Closing the gaps depends on how many controls need a new process. Integrations and policies close fastest. Access reviews, change management and incident response testing take longer because the evidence builds over time. For SOC 2 Type 2, the observation period typically adds three to twelve months once controls are in place.

Before comparing Mycroft alternatives, start with a health check of your current Mycroft account. When the gaps are unconnected integrations, unapproved policies or controls without owners, fixing the setup is faster and keeps your evidence history and audit relationship in place. A switch makes sense when you need an integration or framework Mycroft lacks, or when your audit firm works better in another platform. We operate Vanta, Drata, Secureframe, Scrut, Mycroft and others, so the recommendation follows your environment.

Yes. We configure the Mycroft trust center with your security commitments, compliance status and sub-processors, control access to the SOC 2 report and pen test summary through an access request, and update it after each audit and control change. The AICPA restricts SOC 2 report use to specified parties, so the report itself belongs behind the access request.

Yes. Mycroft lists SOC 2, ISO 27001, ISO 42001, HIPAA, GDPR, CMMC, CPCSC, FedRAMP, PIPEDA and CPRA/CCPA among its supported frameworks, so much of your SOC 2 evidence can carry over to the next one. Each framework adds its own requirements: ISO 27001 adds the ISMS scope (clause 4.3), the Statement of Applicability (clause 6.1.3), internal audit (clause 9.2) and management review (clause 9.3). HIPAA adds the security risk analysis (45 CFR 164.308(a)(1)) and business associate agreements. We build those pieces and operate every framework in the same Mycroft account.

Yes. Our Mycroft consultants deliver the managed Mycroft service remotely for companies across Canada and the United States. Mycroft, your integrations and the audit firm's fieldwork all work online, and your security lead meets your team by video on a schedule set at kickoff.