Customer story · Transportation & logistics technology · 2022 to 2025
From no security program to SOC 2, ISO 27001 and ISO 27701, portfolio-wide.
A transit technology portfolio that powers more than 100 million rides a year, with a diverse set of software companies under one roof, set out in 2022 to strengthen its trust posture, starting with two subsidiaries that had no formal security program at all.
Context
What the work had to do.
The engagement scoped SOC 2 readiness across eight transportation and logistics software companies. The subsidiaries had no information security frameworks, no risk management process, and no IT service management for change, continuity or incident handling, on an aggressive timeline to reach Type I and then scale. Once Type II held, the same program carried the portfolio through ISO 27001 and ISO 27701 initial certification audits, nine companies and SaaS products each.
SOC 2 readiness across eight transportation and logistics software companies, then ISO 27001 and ISO 27701 certification
No formal security programs at the subsidiaries; governance had to be repeatable, not bespoke
Type I first, Type II across the portfolio, then ISO 27001 and ISO 27701 certificates across nine companies
Strategy and execution
What 3HUE did.
Risk assessment and control baseline
A comprehensive risk assessment established one control baseline the whole portfolio could inherit.
ITSM engineered to the controls
Change, continuity and incident management processes were built so operational workflows produced SOC 2 evidence as a by-product.
Managed governance model
Information security, risk management, vendor compliance and cyber incident response run as one managed program, with audit readiness guided through Type I, Type II and expansion planning.
One baseline, three certifications
The SOC 2 control baseline became the ISO 27001 ISMS, then the ISO 27701 privacy extension: one Statement of Applicability per company, one internal audit cycle, and certification bodies briefed from the same register.
Outcomes
What changed.
SOC 2 Type I across Security, Confidentiality and Availability for the first two subsidiaries, in 2023, with no audit findings.
By the end of 2024 the portfolio held SOC 2 Type II across six companies, four of which bypassed Type I entirely.
Initial ISO 27001 certification audits passed across nine companies with zero non-conformities, on the same control baseline the SOC 2 program built.
ISO 27701 privacy certification followed across nine companies and SaaS products, extending each ISMS into a privacy information management system.
- Holistic risk and control posture assessment
- SOC 2 readiness
- ISO 27001 and ISO 27701 certification readiness and audit liaison
- IT service management process engineering
- Managed security and GRC program
- Unified security and risk framework
- ISO/IEC 27001 and ISO/IEC 27701
- ITIL and COBIT practices
- NIST and ISACA risk management practices
If this sounds like you
The lane that fits.
A regulated or multi-entity company that needs one program across several units: the Managed lane, with Client Vision carrying the evidence for every entity.
Outcomes, on the record.
Book fifteen minutes, or send an inquiry. We respond within one business day.