COSA: from a first gap assessment to SOC 2 Type II

Overview

The Committee On Sustainability Assessment (COSA) is a global consortium that measures the sustainability of agricultural supply chains, working with partner organizations around the world. Its work runs on data those partners entrust to it.

As that network grew, so did the expectation that COSA could demonstrate, not just assert, how it protects the data it holds.

The Challenge

This was COSA’s first SOC 2. There was no compliance team, no policy suite, and a lean operations group whose time was already spoken for. The organization needed a credible report soon, and a compliance program it could actually sustain afterward.

Our Solution

Cloudacio staged the path. First a gap assessment against all five Trust Service Criteria, then a focused push to SOC 2 Type I: controls designed and implemented on Google Cloud, policies written for a lean organization rather than a fictional enterprise, and a point-in-time report in hand quickly.

With Type I done, the same controls ran through an observation period with evidence collecting continuously, and Cloudacio coordinated the Type II audit at the end of it. The sequence turned one intimidating project into two manageable ones.

The Results

A Type I report first, then a clean Type II, from a standing start. Compliance now runs year round without a dedicated hire, and the annual renewal is part of operations rather than a scramble.

"Cloudacio took us from our first gap assessment to a clean Type II report and stayed on to keep us audit-ready. Compliance went from a yearly scramble to something that just runs."Louise Salinas, Senior VP of Operations at COSA