From First Questionnaire to Acquisition
Client overview
- Industry: HealthTech, digital pharmacy
- Company: CaryHealth (formerly CaryRx)
- Services: vCISO, SOC 2 readiness and maintenance, HIPAA support, penetration testing, security engineering, security awareness, vendor risk, audit coordination
- GRC platform: Drata
- Relationship: Com-Sec's first client
- Engagement: Began pre-launch and continued through CaryHealth's acquisition by CareTria in May 2026
Executive summary
CaryHealth's security program didn't just pass its acquisition due diligence, it was clean enough that it wasn't a negotiating point.
CaryHealth CEO Areo Nazari knew Farbod from his time leading security at Lark. What started as a small request to help complete a customer SIG questionnaire quickly grew into a long-term partnership. Com-Sec became CaryHealth's embedded security team, building its security framework and leading vCISO, SOC 2 and HIPAA readiness, cloud and application security, penetration testing, employee training, onboarding and offboarding, vendor reviews, audit coordination, compliance, and IT support.
The partnership continued through CaryHealth's growth and eventual acquisition by CareTria to form an integrated direct-to-patient pharmacy platform. Internal delivery reports show the results: a SOC 2 audit with zero findings, full Drata governance and personnel compliance, and a 96/100 external security score.
The challenge
CaryHealth needed a SIG questionnaire answered. Answering it exposed the real problem: no defensible security framework to support enterprise reviews, SOC 2, healthcare requirements, or growth.
As the company scaled, that gap widened, cloud infrastructure, application development, workforce controls, vendor management, customer assurance. Engineering had neither the process nor the time to address vulnerabilities flagged by Dependabot and SonarCloud.The AWS access model relied on practices that got harder to manage safely as headcount grew.
CaryHealth didn't need an audit prep vendor. It needed leadership that could connect governance to engineering, IT, and daily operations.
Com-Sec's approach
Com-Sec started by helping complete the SIG questionnaire, then translated its underlying requirements into a comprehensive SOC 2 program covering governance, policies, controls, training, evidence collection, ownership, risk management, and remediation.
From there: Com-Sec provided ongoing vCISO oversight across the program, including access management, vendor risk, control monitoring, remediation, and coordination with auditors.
On the technical side: planning an AWS Identity Center migration to kill hardcoded credentials and centralize access, monitoring Dependabot and AWS Inspector and GuardDuty alerts, folding high-severity remediation into engineering sprints, and using SonarCloud to harden secure code development practices.
Recurring operations covered access reviews, phishing simulations, security training, endpoint security, email encryption, domain health, device-management evaluation, onboarding/offboarding, vulnerability monitoring, vendor reviews, and penetration testing.
Results
- SOC 2 audit completed with zero findings
- Drata governance maintained at 100% compliance
- 25 of 25 personnel compliant (July 2025 report)
- External SecurityScorecard rating of 96/100
- CrowdStrike Falcon was deployed organization-wide, replacing more expensive legacy endpoint security tools.
- Monthly phishing simulations and targeted employee retraining were implemented as an ongoing program.
- Web app penetration test completed with only four low-severity findings (July 2025)
- Recurring roadmap in place for SOC 2, penetration testing, incident response, business continuity and disaster recovery, risk assessments, access reviews, policy renewals, vendor security
- Program scaled from one customer questionnaire to a multi-year security function that carried CaryHealth through significant growth and its May 2026 acquisition
Why Com-Sec
CaryHealth didn't need five vendors for strategy, compliance, engineering, testing, and daily operations. It needed one team that could move from advice to execution and scale with the company. That's what let the security program hold up under acquisition scrutiny instead of becoming a liability in the deal.
Client perspective
"I brought Farbod one questionnaire because I trusted him from our Lark days. I wasn't shopping for a vendor. That trust is why it turned into the security program that got us through diligence. When CareTria's team went through our environment, it wasn't a red flag. It didn't slow the deal down. That's what I actually paid for, even if I didn't know it at the time."
Areo NazariCEO, CaryHealth
Build security that holds up
Need a security program that can stand up to customer questionnaires, audits, and acquisition diligence? Talk to Com-Sec.