How OTH Security Cuts Audit Readiness Time by 75% Across Regulated Industries

For fast-growing clients across regulated industries, operationalizing a security program quickly is essential to their commercial success; OTH Security partners with Secureframe to enable outstanding delivery. 

‍OTH Security offers fractional security advisory services to mid-market clients across financial services, fintech, and insurance industries. These clients need a mature security program to be able to sell to big enterprises, banks, and other customers, but usually don’t have the budget for an in-house security department to build one.

OTH Security fills in the gap, offering the capabilities of a fractional Chief Information Security Officer (CISO), security engineer, and project manager for a fraction of the price.

“We run their security programs on their behalf. We control the budget, we staff into those companies from a security operations and engineering perspective, and we report up to their executives or their boards,” says Jeff Taylor, CEO and fractional CISO of OTH Security.

Many of these clients hire OTH Security to build and steer their security program to meet specific compliance requirements or simply to implement best practices. In either case, they usually use a compliance framework to provide structure to delivering these programs.

“We’ve done about 35 SOC 2s in the past two years alone, and a bunch more prior to that. But we also do CMMC, NIST frameworks, ISO 9001, ISO 27001, ISO 27017, ISO 27018, TX-RAMP, and other StateRAMPs,” Jeff says.

While OTH Security partners with a handful of other GRC platforms to offer their clients flexibility based on their unique needs, budget, and compliance requirements, they experienced several pain points with other providers. 

Some were immature and required substantial manual effort to use, which defeated the purpose of using the tool. Others had outages that disrupted OTH Security’s and clients’ operations. And others didn’t treat their partners very well: referrals were undercut, feature requests went unanswered, and pricing didn’t reflect the actual value delivered.

As a result, Secureframe has become their preferred platform. 

“We've largely consolidated on Secureframe because of the efficiency. We can get a new Secureframe customer operational in a few hours,” says Jeff. 

One particular client exemplified the pain of doing compliance without a proper platform: their existing security program consisted of 37 spreadsheets that all linked to each other. They had a dedicated compliance manager whose sole job was updating those spreadsheets. Jeff knew this was unsustainable, both for the client and for his firm’s ability to deliver security services efficiently at scale.

“I was working five hours a week on those spreadsheets. Using Secureframe saved me that time and the client those billable hours, so it pays for itself immediately,” says Jeff.

Solutions

Secureframe gave OTH Security the efficiency and true partnership needed to run compliance programs across multiple clients and frameworks efficiently, without the manual overhead of other platforms.

‍The decision to consolidate on Secureframe came down to a combination of a few key factors: pricing, reliability, functionality, and a genuinely productive partnership.

“The price is right relative to the features that we need. The UI is very good. And it's reliable. We've never had an outage so when we need to do something, we can get in there. I've had outages with other platforms, which are pretty embarrassing for me,” Jeff explains.

Day-to-day, OTH Security relies on several Secureframe features to keep their client programs running smoothly:
● Alerts and notifications: Flag upcoming audits, penetration tests, and control deadlines before they become urgent. 
● Email digests sent automatically to department heads: Give cross-functional teams visibility into their compliance responsibilities without requiring constant meetings.
● The policy generator: Lets OTH Security create working drafts for newer clients and iterate from there, rather than starting from a blank page every time.

Results

With Secureframe, OTH Security has dramatically accelerated compliance delivery for its clients and strengthened its position as the faster, modern alternative to traditional security consultants.
‍The most tangible result is speed. While the exact timeline depends on how OTH Security builds the program and the customer’s size and industry, Secureframe reduced the average timeline by 75%.

“Getting the structure of a SOC 2 or a NIST framework moving, getting the right pieces in place, having the conversations, and then getting to an audit takes about 3 months for us when using Secureframe, whereas it would have taken a year without it,” Jeff explains.

Over the past two years alone, OTH Security has delivered 35 SOC 2 reports for customers using Secureframe, a volume that would be extraordinarily difficult to sustain with manual processes or a less mature GRC platform.

The ROI story is equally compelling. OTH Security bills its clients by the hour, so every hour spent on manual evidence collection or spreadsheet maintenance is an hour charged. Secureframe’s automation flips that equation: setting up an integration takes minutes instead of hours, and the platform cost pays for itself almost immediately.

As clients grow and expand into new markets, Secureframe makes it easy to layer on additional compliance frameworks. Clients selling into federal agencies need CMMC, while those expanding to Europe often add ISO 27001 on top of their existing SOC 2. With Secureframe, OTH Security can add these frameworks quickly without starting from scratch.

“CMMC has been the big one lately. We’re seeing more companies wanting to sell to the Department of Defense and other federal agencies so they tell us they need to add CMMC. Or when clients expand into Europe, they often want to add ISO 27001. Since Secureframe is a very scalable solution, meeting evolving requirements from customers is straightforward,” says Jeff.