At A Glace
Use case – SOC 2 Type II readiness, audit coordination, and ongoing vCISO support.
Industry – Product Strategy, Design, and Development Consultancy
Key Takeaways – Partnering with Rhymetec and Sensiba helped Headway receive its first SOC 2 Type II report, increase core device-security adherence from approximately 50% to 100%, and embed security into the way its team builds, collaborates, and delivers for customers.
Service Provided
- SOC 2 Audit
Challenge
As Headway became more embedded in customer teams and environments, informal security practices were no longer enough. The company needed documented controls that guided how its people worked and gave customers confidence in the team they brought into their business.
As a product consultancy rather than a traditional SaaS company, Headway also needed to define the right SOC 2 scope, apply controls across employees and contractors, establish practical Bring Your Own Device requirements, and engage a reliable auditor, all without slowing down its designers and developers.
TESTIMONIALS
What Others Say About Us
It made it more efficient because I didn’t have to sit in the middle. The ability to have both companies working together, with me in observation rather than acting as a blocker, was awesome.
Eric Verboncouer
Partner and COO, Headway
Solution
Headway partnered with Rhymetec to build the security program aligned with the way its teams actually work, and with Sensiba to independently examine that program through a SOC 2 Type II audit.
Rhymetec provided vCISO leadership that extended beyond traditional advisory services. The team helped define Headway’s SOC 2 scope, developed practical policies, implemented secure code review, third-party management, access management, and device-security processes, and prepared the company for audit.
Together, Rhymetec and Sensiba ensured a coordinated SOC 2 process, aligning controls with employee workflows, managing evidence and findings, and keeping Headway informed without requiring Eric to manage every handoff.
Implementation Journey
1. Engaged Rhymetec’s vCISO Manager Tier to lead SOC 2 strategy and execution
2. Defined the correct SOC 2 scope for Headway’s consultancy model
3. Developed policies and standardized security requirements to align with Headway’s culture and existing workflows
4. Implemented key controls across access management, secure code review, third-party management, and security awareness
5. Coordinated with Sensiba throughout the SOC 2 Type II audit
6. Transitioned from implementation leadership to ongoing guidance and high-level program oversight
Outcome
- Increased adherence to core device-security practices from approximately 50%* to 100%
- Maintained broader security-process adherence in the high 90s across the full team
- Reduced initial client setup from two to three days with client-provided equipment to approximately two to three hours with Headway’s approved devices
- Received Headway’s first SOC 2 Type II report, establishing independent evidence of its security maturity
- Built the foundation needed to pursue the 60%+ of projected pipeline expected to require SOC 2
Ready to get started?
Discover how our technology team can help you solve complex challenges and unlock new opportunities. Contact us to learn more about our full range of technology solutions and services.
Case Studies
Ready for more inspiration? Dive into additional client success stories where we showcase diverse projects, innovative solutions, and the transformative impact we’ve had on businesses like yours.
