Question 1

Is S2 Cognition LLC SOC 2 compliant?

Accepted Answer

S2 Cognition LLC is SOC 2 compliant. On SOC2C this listing is Listed.

Question 2

Is S2 Cognition LLC PCI DSS compliant?

Accepted Answer

According to S2 Cognition LLC's public trust center, S2 Cognition LLC is PCI DSS compliant. On SOC2C this listing is Listed.

Question 3

Is S2 Cognition LLC CMMC compliant?

Accepted Answer

According to S2 Cognition LLC's public trust center, S2 Cognition LLC is CMMC compliant. On SOC2C this listing is Listed.

Question 4

Is S2 Cognition LLC CSA STAR certified?

Accepted Answer

According to S2 Cognition LLC's public trust center, S2 Cognition LLC is CSA STAR certified. On SOC2C this listing is Listed.

Question 5

Is S2 Cognition LLC CCPA compliant?

Accepted Answer

According to S2 Cognition LLC's public trust center, S2 Cognition LLC is CCPA compliant. On SOC2C this listing is Listed.

Question 6

Is S2 Cognition LLC PIPEDA compliant?

Accepted Answer

According to S2 Cognition LLC's public trust center, S2 Cognition LLC is PIPEDA compliant. On SOC2C this listing is Listed.

Question 7

Can I use S2 Cognition LLC's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. S2 Cognition LLC's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 8

Is S2 Cognition LLC penetration tested?

Accepted Answer

S2 Cognition LLC hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 9

Is S2 Cognition LLC secure?

Accepted Answer

Security isn't a single yes/no, but S2 Cognition LLC is SOC 2 compliant and holds PCI DSS, CMMC, CSA STAR, CCPA, PIPEDA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 10

Does S2 Cognition LLC have a bug bounty or vulnerability disclosure program?

Accepted Answer

S2 Cognition LLC hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@s2cognition.com or via a /security page (S2 Cognition LLC lists a security contact).

Question 11

Who are S2 Cognition LLC's subprocessors?

Accepted Answer

S2 Cognition LLC lists 7 subprocessors on its trust center, including Microsoft 365, monday.com, Adobe, Klaviyo, Slack. Buyers use this for fourth-party risk review.

Question 12

Where does S2 Cognition LLC host or store data?

Accepted Answer

S2 Cognition LLC's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

Question 13

Where is S2 Cognition LLC's trust center or security page?

Accepted Answer

S2 Cognition LLC's trust center is at https://trust.s2cognition.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 14

Does S2 Cognition conform with a specific industry-standard security framework?

Accepted Answer

S2 Cognition's Information Security and Privacy Program establishes policies and controls, monitors compliance with those controls, and proves security and compliance to third-party auditors. The security policies and controls are grounded in the key principles of zero trust, least privilege, need-to-know, and segregation of duties, and govern access to facilities, systems, and data. The policies are refreshed annually, approved by senior management, and reviewed by independent auditors. S2 Cognition's Information Security & Privacy Program has created a security framework based on the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Rev. 2 (14) control families for the Protection of Controlled Unclassified Information in Non-Federal Information Systems and Organizations as the foundation for the S2 Cognition Information Security policy, standards, and controls. This is also in alignment with the family of (14) domains and controls found in the ISO 27001:2022 Standard and the AICPA SOC 2 Trust Services Criteria. S2 Cognition believes that the implementation of controls should be applied consistently across all areas of the enterprise, iterative, continuously maturing across the dimensions of improved effectiveness, and provide increased auditability and decreased friction.

Question 15

Where are S2 Cognition's servers located?

Accepted Answer

S2 Cognition operates within Amazon Web Services (AWS). S2 Cognition leverages AWS components to provide reliable, fault-tolerant, and highly available systems in the cloud. AWS follows the Shared Responsibility Model. AWS is responsible for the security of the cloud, and S2 Cognition is responsible for security in the cloud. S2 Cognition's infrastructure is hosted in US-based AWS data centers housed in state-of-the-art facilities that maintain a highly secure server environment with 24x7 monitoring, surveillance, and support to prevent unauthorized access and ensure data security. Advanced security measures including firewalls, security guards, and surveillance are taken to ensure the continued service and protection of operational data from natural disasters, intruders, and disruptive events. These data centers meet industry standards such as ISO 27001:2022, SOC 2, CSA STAR CCM v4.0, FedRAMP, CMMC, etc. They are rigorously audited annually by third parties. If you are required to review the data center SOC report, you can review the latest AWS SOC 3 Report. Learn more about the AWS North America Regions and Availability Zones.

Question 16

Does S2 Cognition encrypt sensitive data at rest and in transit?

Accepted Answer

All datastores with customer data, in addition to S3 buckets, are encrypted at rest using 256-bit Advanced Encryption Standard (AES) encryption. S2 Cognition uses the Amazon Web Services (AWS) Key Management Service (KMS) to enable data at rest encryption across S2 Cognition's products. S2 Cognition uses this for encrypting data within databases (RDS), and data stored within S3. AWS KMS uses the Advanced Encryption Standard (AES) algorithm in Galois/Counter Mode (GCM) with 256-bit secret keys. Data is logically separated and access is granted to authorized users only. S2 Cognition uses Transport Layer Security (TLS) 1.2/1.3 encryption and Hypertext Transfer Protocol Secure (HTTPS) for all data transported through S2 Cognition's network servers. S2 Cognition currently uses Load Balancer and CloudFront Security Policies supporting TLS 1.2 and higher. Details of this can be found here. All connections to S2 Cognition's servers are protected by Secure Sockets Layer (SSL) encryption.

Question 17

Does S2 Cognition conduct penetration tests and vulnerability scans?

Accepted Answer

S2 Cognition conducts an independent external penetration test annually and requires vulnerability scanning at key stages of the Secure Development Lifecycle (SDLC). All areas of S2 Cognition's products and cloud infrastructure are in-scope for these assessments. The S2 Cognition information security team performs monthly web application vulnerability scans. These scans are configured to run as authenticated scans. Any vulnerabilities found during these scans or any other vulnerability discovery activities are added to a vulnerability tracking system. There, the vulnerabilities are verified, categorized, and evaluated for actual risk. Vulnerabilities are remediated in accordance with the schedule listed below: The following SLA is followed for vulnerability findings based on a CVSS. Non-CVSS scored vulnerabilities with a risk score are determined by leveraging the OWASP Risk Rating Methodology (Risk = Likelihood \* Impact). - Critical Severity = 30 days - High Severity = 60 days - Medium Severity = Discretionary - Low Severity = Discretionary - Informational Severity = Discretionary If you feel you have discovered a security flaw in our system, you can submit any vulnerabilities by contacting the S2 Cognition information security team directly at [Security@s2cognition.com](mailto:security@s2cognition.com).

Question 18

Does S2 Cognition have a Bug Bounty Program?

Accepted Answer

Security Notice – Responsible Disclosure At S2 Cognition, we are committed to protecting the confidentiality, integrity, and availability of our systems and data in accordance with our SOC 2 controls. While we do not currently offer a public bug bounty program, we encourage responsible disclosure of any identified vulnerabilities in our products or services. Your efforts help us maintain a secure and trustworthy environment. To report a potential security issue, please contact us at: [Security@s2cognition.com](mailto:security@s2cognition.com) When reporting, please include: - A clear description of the issue - Steps to reproduce the vulnerability - Any relevant technical details or tools used - Your contact information so we can follow up We will acknowledge your report within three (3) business days and maintain communication throughout our assessment and resolution process. Please do not publicly disclose any vulnerabilities without written permission from S2 Cognition. Responsible disclosure helps us strengthen our controls and reinforces our commitment to SOC 2 compliance. Thank you for supporting the security of our platform.

Question 19

Does S2 Cognition maintain a risk management program, perform risk assessments, and track the treatment of those risks?

Accepted Answer

S2 Cognition has a risk management program in place and performs an annual company-wide risk assessment in addition to quarterly follow-up meetings with risk owners. S2 Cognition uses Vanta to manage and track these risks as they are mitigated and treated. The S2 Cognition risk management process is the integration of people, processes, and tools that continuously identify and mitigate enterprise risks. The risk assessment program includes the following: - Identification of enterprise risks - Assigning risks to risk owners - Review the impact and likelihood of risks - Implement mitigations to risks based on risk tolerance - Monitoring the effectiveness of risk mitigation S2 Cognition's risk management program provides stakeholders an enterprise-wide understanding of the risks to the organization, what is being done to manage those risks, and how effective the risk management program is performing. S2 Cognition's risk management program is reviewed as part of S2 Cognition's annual third-party audit (SOC 2). The risk management program is approved and supported by S2 Cognition's senior management and formal risk reporting to the Board of Directors is conducted which results in: - Ensuring accountability and competence for managing risks across the organization - Ensuring effective, relevant, and timely exchange of information with internal and external stakeholders - Support of decision-making processes fully aligned with risk exposure - Ensuring risk owners and governing bodies are provided with all relevant information to conduct their activities

Question 20

Does S2 Cognition conduct security and privacy awareness training with its employees?

Accepted Answer

All S2 Cognition employees complete mandatory security awareness and privacy training upon hire and at least once annually. S2 Cognition conducts simulated phishing and social engineering tests on an ongoing basis at least once a month. All S2 Cognition employees and contractors sign confidentiality and non-disclosure agreements upon hire and before access to company or customer data. Security bulletins and announcements are shared throughout the year to give timely reinforcement reminders for awareness and education.

Question 21

How does S2 Cognition deploy its architecture?

Accepted Answer

S2 Cognition follows best practice for the deployment and maintenance of its systems and for data maintained within S2 Cognition's data centers and cloud services. Systems are securely designed and are reviewed by the information security team before being put into production. The S2 Cognition Research and Development (R&D) team leverages a Continuous Integration / Continuous Delivery (CI/CD) pipeline for managing code deployments. Code changes are peer reviewed, approved by QA staff, and tested in a staging environment before they are pushed into production. The staging and production environments are logically separated, and no data is shared between them. Critical data and systems are replicated and backed up to secondary data centers. These backups are stored encrypted in accordance with the data encryption FAQ listed above.

Question 22

What is S2 Cognition's approach to perimeter security?

Accepted Answer

S2 Cognition implements and layers security controls according to the principle of defense-in-depth, which ensures separation between production and lower environments, and between the public internet and non-public infrastructure components. S2 Cognition uses a combination of Amazon Web Services (AWS) Virtual Private Clouds (VPCs), VPC subnets, Network Access Controls Lists (NACLs), AWS Security Groups, and AWS DB Subnet Groups to provide logical network-level isolation. S2 Cognition protects data, servers, and endpoints using industry best security controls. These controls include next generation anti-virus/anti-malware, web security, email security, and Amazon GuardDuty for intelligent threat detection and continuous monitoring of any suspicious activity in our production systems. This allows S2 Cognition to prevent malicious network attacks, prevent access to suspicious or malicious sites, prevent malicious emails or attachments, and mitigate zero-day attacks. S2 Cognition also uses AWS Security Hub to automate security best practice checks, aggregate security alerts into a single place and format, and understand the overall security posture.

Question 23

What identity and access management controls does S2 Cognition have in place?

Accepted Answer

Access and processing capabilities are limited to only those with a legitimate business need and granted based on the principle of least privilege. S2 Cognition employees are granted access to applications based on their role, and automatically deprovisioned upon termination of their employment. Further access must be approved according to the policies set for each application. A unique user ID with a complex password is assigned to authorized users and is required to login. Passwords are required to be changed frequently. Multi-factor authentication (MFA) is required for remote access and access to cloud systems. Administrative functions are facilitated through separate privileged accounts.

Question 24

How does S2 Cognition configure and secure user devices across the Enterprise?

Accepted Answer

All corporate devices are centrally managed and are equipped with mobile device management (MDM) software and anti-malware protection. Endpoint security alerts are monitored with 24/7/365 coverage. S2 Cognition uses MDM software to enforce secure configuration of endpoints, such as disk encryption, screen lock configuration, and software updates.

Question 25

What is S2 Cognition's perspective on Data Privacy?

Accepted Answer

S2 Cognition is committed to the protection and privacy of data. The protection and management of data entrusted to us is one of our highest priorities. S2 Cognition has appointed a Data Privacy Officer (DPO) and has a dedicated privacy team. The privacy team can be contacted at [Privacy@s2cognition.com](mailto:privacy@s2cognition.com). S2 Cognition follows a least privilege access model and regularly audits individuals' access to data. S2 Cognition respects individuals’ right to privacy and we are consistently working to remain compliant with privacy regulations. S2 Cognition’s Privacy Policy further details how customer data is handled.

S2 Cognition LLC

About

Compliance & infrastructure

Subprocessors

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Sports peers that completed SOC 2

Ease Live AS

Field Day Inc

BreakAway Data

Reboot Motion Inc