The Human Side of SOC 2 Certification
The Human Side of SOC 2 Certification
Posted on: January 29, 2026When a company earns its System and Organizational Controls (SOC) certification, its clients can rest easy knowing that best practices are in place to keep their data secure – but what’s actually involved in obtaining certification?
Vanguard has recently achieved SOC 2, Type 1 certification, so we now know the ins and outs of what the audit process entails: hard work, a commitment to excellence and a dedicated team. Four individuals – Brian Rains, Jeff Hoffman, Jennifer Gilliam and Adam Briggs – were instrumental in leading the process.
What Is SOC 2 Certification?
SOC 2 reports are developed by the American Institute of Certified Public Accountants (AICPA) as a standard to show how service organizations manage customer data. It’s a voluntary framework, so companies are not legally required to go through the process, but they may choose to undergo the auditing process to demonstrate their commitment to keeping customer data secure.
SOC 2 compliance is based on five elements:
• Security
• Availability
• Processing Integrity
• Confidentiality
• Privacy
The SOC certification is more than a compliance benchmark; it’s a strategic differentiator. As Brian Gilliam, Vanguard’s President and CEO explains, “This milestone strengthens our position as a trusted partner for Insurance companies, managing general agencies, Lloyd’s syndicates, risk retention groups and self-insured entities across the United States.”
Why SOC2 Certification Is Worthwhile
Brain Rains, Project Manager at Vanguard, explains why SOC2 certification is worth the effort. “It’s essential to me to demonstrate that Vanguard upholds the highest standards, not only in claim handling, but also in data integrity and security,” he says. “SOC 2 demonstrates our commitment to these standards to our clients and the world.”
Jennifer Gilliam, Vanguard’s Chief Human Resources Officer, offers a unique perspective. “As an HR VP, SOC2 is important to me as it helps protect our employees and company from breaches and liability. In addition, it helps protect the company legally and reputationally.”
Overcoming Challenges to Secure SOC2 Certification
For Jeff Hoffman, Director, IT Services at Vanguard, translating information practices into consistent and auditable processes across the organization was the biggest challenge. “We already had many strong technical and security practices in place,” he explains, “but we needed clearer ownership, documentation, and evidence to make those practices consistently repeatable and auditable.”
Adam Briggs, VP Finance and Accounting, says the level of detail required was more granular than he expected. “Going through the SOC2 process has opened my eyes with respect to the amount of oversight needed to ensure data and system security. It helped me better understand what separate parts of the company are doing and how business units work together to create the superior service and products Vanguard provides.”
Appreciating the Human Aspects of Data Security
SOC2 compliance may not seem like an HR issue, but it is. “The people risk is just as serious as the technical risk,” says Jennifer.
Brian had a similar experience with the process. “It quickly became apparent that this was an exercise in innovation, combining people and technology to strengthen controls, policies and employee behavior, creating a culture that works toward the same goal,” he explains.
Managing a Cultural Shift
Documentation is important, but the Vanguard team quickly learned that SOC2 certification required much more.
“I initially thought it was mainly a documentation exercise,” says Jeff. “In reality, it requires deep operational alignment and sustained behavior change.”
“Becoming SOC 2 compliant isn’t just about procedures, policies and technology,” says Brian. “At its core, it’s a behavioral and cultural shift among employees toward stronger documentation, effective change management and enhanced data security handling.”
The Vanguard team achieved their goal of earning SOC2 Type 1 certification, and beyond that, they learned about the importance of data security.
“Overall, I would say that this has made me more process-driven and disciplined,” says Jennifer.
We’re proud of our SOC2 Type 1 certification, and of the individuals whose hard work and commitment to excellence made it possible.
Are you looking for a claims management provider that takes data security seriously? Contact us.