Uprite completed a SOC 2 Type 1 examination with Assure Professional in May 2023. A Type 1 report attests that security controls were suitably designed and in place on a specific date. It is a point in time opinion from an independent accountant, not an ongoing guarantee.
What the examination covered
SOC 2 is an auditing standard from the American Institute of Certified Public Accountants. It measures a service organization against the Trust Services Criteria. Security is the mandatory one. Assure Professional, a firm that performs compliance audits, reviewed Uprite’s security policies, operations and practices against that criteria and issued its opinion in accordance with AICPA guidelines, confirming the controls met SOC 2 security standards for the confidentiality of client data. The scope was design. Not duration.
What a Type 1 report does not prove
Quite a lot, as it happens. A Type 1 opinion says controls were designed appropriately and were in place when the auditor looked. It says nothing about whether they held up over the months that followed. That is what a Type 2 report tests, across an observation window that usually runs six to twelve months. We wrote the long version in SOC 2 Type 1 vs Type 2.
Neither type guarantees that nothing goes wrong. What a SOC 2 report gives a buyer is an independent accountant’s opinion, with the scope and any exceptions written down, instead of a vendor’s assurance about itself, which is the whole reason procurement teams ask for one rather than taking a security page at face value. That is a real upgrade on a marketing claim. It is not a shield.
A point in time report has a date, and the date is the point
Uprite’s examination was completed in May 2023. A Type 1 opinion does not roll forward on its own. Any provider that cites a SOC 2 report without naming the examination date is asking you to assume a currency it has not demonstrated, and that applies to us as much as it does to anyone we compete with. So ask for the date. Then ask for the report.
Why your provider’s own audit belongs on your risk register
A managed service provider holds privileged access to every environment it supports. Administrative credentials. Remote monitoring agents. Backup systems, directory services, patching tooling. All of it sits inside the provider’s own stack, which means the provider’s controls are part of your attack surface whether or not anyone has ever looked at them, and that exposure does not shrink because the contract happens to call it a managed service.
Most buyers never look. An independent examination is one of the few practical ways to check without commissioning an audit of your own, and it is a fair thing to ask of anyone you are evaluating, alongside how they scope and deliver managed security services.
What to ask any MSP about its SOC 2 report
- Which report type is it. Type 1 attests design. Type 2 tests operation across a window.
- When did the examination period end. The report is evidence about that period and nothing after it.
- What was in scope. A report can cover one system and quietly exclude the one that touches your data.
- Were there exceptions. Auditors write them down. Vendors rarely volunteer them.
- Which Trust Services Criteria were included. Security is mandatory. Availability, confidentiality, processing integrity and privacy are optional additions.
- Can you read the full report. A badge on a website is not a report. Most providers will share one under NDA.
If a provider cannot answer those six, the badge is decoration.
The other compliance work behind the badge
SOC 2 is not the only attestation a provider can show you. Uprite also completed Compliancy Group’s implementation program and earned its Seal of Compliance, covered in our HIPAA compliance announcement. For clients whose obligations arrive through federal contracts, our CMMC and NIST 800-171 services handle that track separately. Assessing your own regulatory position is different work again, scoped on our compliance and regulatory assessment page.
The internal standard behind it
Stephen Sweeney, President of Uprite Services, tied the certification back to the company’s own operating principles. “The Uprite Way #2 is ‘Keep both Uprite and our clients secure.’ SOC 2 certification is yet another demonstration of Uprite’s commitment to the security of our clients.”
Those principles are set out in full on The Uprite Way. Uprite is a Texas managed service provider headquartered in Houston, delivering managed IT services, cybersecurity, cloud and managed phone solutions to businesses across the state from offices in Houston, Dallas and San Antonio. More background sits on our about page.
Questions buyers ask about our SOC 2 report
Is Uprite SOC 2 certified (2023)?
Uprite completed a SOC 2 Type 1 examination with Assure Professional in May 2023. That attestation covers how controls were designed and implemented as of that examination. It is the most recent SOC 2 examination Uprite has completed.
What is the difference between SOC 2 Type 1 and Type 2?
Design versus evidence. Type 1 confirms controls were suitably designed and in place at a point in time. Type 2 goes further and tests whether they operated effectively across a review period, usually six to twelve months.
Who performed Uprite’s SOC 2 examination?
Assure Professional, an independent firm that performs compliance audits, conducted the examination in accordance with AICPA guidelines. The review covered Uprite’s security policies, operations and practices.
Does a SOC 2 report mean my data cannot be breached?
No. A SOC 2 report is an accountant’s opinion on a control environment, not a warranty against incidents. Its value is that the scope and any exceptions are written down by someone with no commercial stake in the answer, which is more than a vendor claim gives you.
Should I ask my MSP for its SOC 2 report?
Yes, and ask early. Your provider holds administrative access to your environment, so its controls sit inside your risk picture. Ask for the report type, the examination date, the systems in scope and any noted exceptions.
How current does a SOC 2 report need to be?
There is no universal rule, though many procurement teams treat a Type 2 report older than 12 months as stale and treat a Type 1 as evidence about its examination date only. Whatever threshold you set, apply it to every provider in the comparison rather than to one.
Original announcement on BusinessWire.
Evaluating a provider’s security posture?
Speak to an IT ExpertBring us the same six questions. We will walk you through what our examination covered and where the boundaries sit.
