Our Commitment to Compliance and Trust

At Roark Tech Services, security and compliance are not boxes to check. They are the foundation of every decision we make, from how we architect client systems to how we monitor our own. One principle governs both: trust is earned through discipline and transparency.

Roark completes an annual SOC 2 Type II examination and aligns its practices with the NIST Cybersecurity Framework, NIST 800-53, and the HIPAA Security Rule. A Type II examination measures controls not at a single moment but across a period of months, which means our safeguards have been independently tested for effectiveness rather than merely well described on paper.

For our clients, that discipline is what allows an examiner’s request, an insurer’s questionnaire, or a prospective investor’s due diligence to be answered with evidence rather than assurances. We complete client due diligence questionnaires as a standard part of service and make our SOC 2 Type II report available under NDA.

Our Compliance Frameworks

SOC 2 Type II

Our systems, policies, and processes are examined against the AICPA Trust Services Criteria for Security, Availability, and Confidentiality. The Type II report attests that our controls are consistently applied and effective across the full examination period, not merely on the day the auditor visited.

NIST Alignment

We align with NIST 800-53 and the NIST Cybersecurity Framework, so that our governance, risk, and security programs meet or exceed federal best practice. Policies are reviewed annually and after any material change to the environment.

HIPAA Safeguards

For clients handling protected health information, Roark operates as a business associate under a signed Business Associate Agreement. Our policies and procedures reflect the administrative, technical, and physical safeguards of the HIPAA Security Rule, protecting the confidentiality, integrity, and availability of patient data.

Trust Center

Transparency is foundational to trust. Our Trust Center gives you direct access to Roark’s security practices, compliance attestations, audit reports, and privacy policies, so you can evaluate how we protect your business before you ever sign anything. VISIT OUR TRUST CENTER

Designated Data Privacy Officer

Our designated Data Privacy Officer oversees data protection, privacy compliance, and regulatory alignment with SOC 2, HIPAA, NIST 800-53, GDPR, UK GDPR, and applicable US state privacy laws. The DPO leads privacy incident response, manages data access reviews, and ensures that client and employee data is handled in confidence.

Contact: DPO@roarkinc.com

RESPONSIBILITIES INCLUDE:

Responding to data subject inquiries and breach notifications
Ensuring continued compliance with SOC 2, HIPAA, and NIST-aligned privacy requirements

Maintaining and enforcing Roark’s Data Privacy and Confidentiality Policy
Overseeing access control, encryption, and data retention practices
Reviewing and approving data-sharing agreements and vendor privacy commitments

Controls That Uphold Our Compliance

ACCESS & IDENTITY MANAGEMENT

Role-based access control with least-privilege enforcement

Multifactor authentication across all systems

Centralized identity management through Microsoft Entra ID (Azure AD)

Quarterly access reviews for administrative and privileged accounts

SYSTEM MONITORING & DETECTION

24/7 Security Operations Center (SOC)

Continuous endpoint monitoring and behavioral threat detection

Next-generation SIEM integration for log correlation and incident response

Automated alert triage

EMAIL SECURITY &
DATA LOSS PREVENTION

Enterprise-grade email protection powered by Proofpoint

Advanced threat detection, sandboxing, and URL rewriting to prevent phishing and spoofing

Email encryption and secure message delivery for sensitive communications

Data loss prevention (DLP) policies aligned with HIPAA and NIST SP 800-171

SPF, DKIM, and DMARC enforcement across all Roark domains

DATA PROTECTION & BACKUP

Encrypted backups (at rest and in transit) using NinjaOne SaaS Backup and Microsoft 365

Routine backup validation and restoration testing

Data retention policies aligned with SOC 2 and NIST SP 800-171

NETWORK & ENDPOINT SECURITY

Firewall management with monthly rule-set review

DNS filtering and content control for all managed devices

Endpoint hardening and USB device control

Vulnerability scanning and patch automation

GOVERNANCE & RISK MANAGEMENT

Documented Written Information Security Program (WISP)

Risk assessments conducted semi-annually

Vendor due-diligence and third-party risk reviews

Auditable policy distribution, tracking, and compliance attestation

INCIDENT RESPONSE
& BUSINESS CONTINUITY

Formal Incident Response Plan tested annually

24/7 escalation and communication procedures

Business continuity and disaster recovery testing

Post-incident reviews with root-cause documentation

TRAINING & AWARENESS

Mandatory, ongoing cybersecurity awareness training for all staff

Monthly phishing simulations and compliance quizzes

Signed acknowledgment of all security and confidentiality policies

We hold ourselves to the standard we build for you. That includes our own use of artificial intelligence, which is governed by the same policies, logging, and review we recommend to clients.