Client stories

    Real Clients. Real Security Outcomes.

    See how Com-Sec helps technology teams make security, compliance, and customer assurance part of everyday operations.

    Back to HealthTech case studies

    One Team for Compliance, Security, and IT

    Client Overview

    • Industry: HealthTech
    • Company: Rave Health
    • Services: Managed IT, vCISO, SOC 2, penetration testing
    • GRC platform: Drata
    • Auditor: Atom
    • Engagement: August 2024 to present

    Executive Summary

    Rave Health needed a security partner that could support both compliance and day-to-day operations. The company required SOC 2 guidance, penetration testing, executive-level security leadership, and ongoing IT support without adding the complexity of managing multiple separate providers.

    Com-Sec brought those responsibilities together under one engagement. The team guided the SOC 2 program in Drata, coordinated with Atom throughout the audit, supported evidence collection and remediation, delivered penetration testing, and remained involved in recurring IT and security operations.

    As Rave Health moved through the final stage of its SOC 2 audit, Com-Sec continued working through the remaining findings and providing the supporting evidence needed for closure. Because the same team understood both the technical environment and the compliance program, issues could be addressed with more context and fewer handoffs between vendors.

    The Challenge

    Rave Health needed to strengthen several areas at the same time: SOC 2 compliance, penetration testing, executive-level security guidance, and everyday IT support.

    For a lean team, managing each of those functions through separate providers would have added unnecessary coordination, handoffs, and overhead.

    The SOC 2 program required ongoing attention across Drata, evidence collection, control remediation, access reviews, policies, and auditor requests. At the same time, technical security needed to be validated through penetration testing while day-to-day IT issues continued to require support.

    The challenge was finding a model that could connect compliance, technical security, and IT operations rather than treating them as separate projects. Rave Health needed consistent ownership and a team that understood both its audit requirements and the technical environment behind them.

    Com-Sec's Approach

    Com-Sec brought Rave Health's compliance, technical security, and IT needs together under one operating model.

    Monthly meetings created a consistent cadence for reviewing SOC 2 progress, open risks, remediation items, and upcoming priorities. Ad hoc sessions provided additional space to work through deeper technical topics such as AWS configuration and cloud security.

    Day-to-day communication stayed active through Slack, giving Rave Health a direct channel for questions, operational issues, and time-sensitive security concerns.

    Com-Sec also supported the broader security culture through recurring newsletters and phishing campaigns designed to keep employees engaged and strengthen security awareness between formal training cycles.

    Monthly reporting tied the program together by giving Rave Health clear visibility into ongoing security and compliance work. Alongside that reporting, Com-Sec continued guiding the SOC 2 program, coordinating with Atom, supporting evidence collection and remediation, delivering penetration testing, and staying involved in recurring IT and security operations.

    Results

    • SOC 2 remediation progressed from multiple open findings to one remaining evidence item in the latest internal record.
    • Ongoing remediation, evidence collection, and control validation supported, including direct coordination with the auditor.
    • Penetration testing incorporated into the security program, with identified findings remediated.
    • Ongoing vCISO guidance, IT support, audit coordination, and security operations established under one team.
    • Consistent support provided across strategic security initiatives and day-to-day operational needs since August 2024.

    Why Com-Sec

    Rave Health didn't have to translate between an auditor, a penetration tester, an IT provider, and a strategic advisor.

    Com-Sec connected the work and kept the program moving. Instead of treating compliance, technical security, and IT as separate projects, the engagement gave Rave Health one team with context across all three.

    Client Perspective

    "Com-Sec gives us one team for the security work that would otherwise be spread across several providers. They understand the audit, the technology, and what our team needs day to day."

    Richard KaskelCEO, Rave Health

    Build security without managing multiple providers

    Need a security program that connects compliance, technical security, and day-to-day IT operations? Talk to Com-Sec.