--- title: Trust & Security | IT Raven description: "How IT Raven secures data: Microsoft Purview classification and DLP, AES-256 and TLS 1.2 encryption, Defender XDR, 24/7 monitoring, 30 documented policies." image: https://itraven.net/hubfs/itraven-site/2026-10/og-image-night-1200x630.webp --- [![IT Raven](https://itraven.net/hs-fs/hubfs/itraven-site/brand2/itraven-lockup-inverse-2x.png?width=180&height=36&name=itraven-lockup-inverse-2x.png)](https://itraven.net/?hsLang=en) ![menu](https://f.hubspotusercontent40.net/hubfs/7479797/menu.png) ![close\_24px](https://7479797.fs1.hubspotusercontent-na1.net/hubfs/7479797/close_24px.svg) - [Home](https://itraven.net) - [Solutions](https://itraven.net/solutions) Show submenu for Solutions - Secure & Govern Show submenu for Secure & Govern - [Cybersecurity](https://itraven.net/solutions/cybersecurity) - [Compliance & Risk](https://itraven.net/solutions/compliance-risk) - [Data Governance](https://itraven.net/solutions/data-governance-kg) - [Physical Security](https://itraven.net/solutions/physical-security) - Connect & Communicate Show submenu for Connect & Communicate - [Connectivity](https://itraven.net/solutions/connectivity-wan) - [SASE / SD-WAN](https://itraven.net/solutions/sase-sdwan) - [UCaaS & Voice](https://itraven.net/solutions/ucaas-voice) - [Contact Center](https://itraven.net/solutions/ccaas) - [Mobility](https://itraven.net/solutions/mobility) - Cloud & Infrastructure Show submenu for Cloud & Infrastructure - [Cloud & IaaS](https://itraven.net/solutions/cloud-iaas) - [Data Center](https://itraven.net/solutions/datacenter-colo) - [Backup & DR](https://itraven.net/solutions/backup-dr) - [Managed IT](https://itraven.net/solutions/managed-it) - [Integration (iPaaS)](https://itraven.net/solutions/ipaas) - Grow & Specialize Show submenu for Grow & Specialize - [CX & AI](https://itraven.net/solutions/cx-ai) - [Legal AI](https://itraven.net/solutions/legal-ai) - [Workforce Training](https://itraven.net/solutions/workforce-training) - [Demand Gen](https://itraven.net/solutions/demand-gen) - [Public Sector](https://itraven.net/solutions/public-sector) - [All Solutions →](https://itraven.net/solutions) - [Assessments](https://itraven.net/assessments) - [Store](https://store.itraven.net/) - [Industries](https://itraven.net/industries) - [Trust](https://itraven.net/trust-center) - [About](https://itraven.net/about-us) - [Contact](https://itraven.net/contact-us) - [Blog](https://itraven.net/blogs) - [Home](https://itraven.net) - [Solutions](https://itraven.net/solutions) Show submenu for Solutions - Secure & Govern Show submenu for Secure & Govern - [Cybersecurity](https://itraven.net/solutions/cybersecurity) - [Compliance & Risk](https://itraven.net/solutions/compliance-risk) - [Data Governance](https://itraven.net/solutions/data-governance-kg) - [Physical Security](https://itraven.net/solutions/physical-security) - Connect & Communicate Show submenu for Connect & Communicate - [Connectivity](https://itraven.net/solutions/connectivity-wan) - [SASE / SD-WAN](https://itraven.net/solutions/sase-sdwan) - [UCaaS & Voice](https://itraven.net/solutions/ucaas-voice) - [Contact Center](https://itraven.net/solutions/ccaas) - [Mobility](https://itraven.net/solutions/mobility) - Cloud & Infrastructure Show submenu for Cloud & Infrastructure - [Cloud & IaaS](https://itraven.net/solutions/cloud-iaas) - [Data Center](https://itraven.net/solutions/datacenter-colo) - [Backup & DR](https://itraven.net/solutions/backup-dr) - [Managed IT](https://itraven.net/solutions/managed-it) - [Integration (iPaaS)](https://itraven.net/solutions/ipaas) - Grow & Specialize Show submenu for Grow & Specialize - [CX & AI](https://itraven.net/solutions/cx-ai) - [Legal AI](https://itraven.net/solutions/legal-ai) - [Workforce Training](https://itraven.net/solutions/workforce-training) - [Demand Gen](https://itraven.net/solutions/demand-gen) - [Public Sector](https://itraven.net/solutions/public-sector) - [All Solutions →](https://itraven.net/solutions) - [Assessments](https://itraven.net/assessments) - [Store](https://store.itraven.net/) - [Industries](https://itraven.net/industries) - [Trust](https://itraven.net/trust-center) - [About](https://itraven.net/about-us) - [Contact](https://itraven.net/contact-us) - [Blog](https://itraven.net/blogs) [GET STARTED](https://itraven.net/contact-us?hsLang=en) Trust & Security # Secure by design, not by promise. We're a Microsoft-security-built MSP. Here's exactly how we protect data, ours and our clients'. [Get a free security evaluation](https://itraven.net/assessments?hsLang=en)[Questions? security@itraven.net](mailto:security@itraven.net) Fortune 1000 experience500+ partner networkMicrosoft-builtSecurity-first How to read this page ## The same discipline, ours and yours We run a security-first practice on our own Microsoft-built platform, and the controls we hold ourselves to are the same discipline we bring to client engagements. This page describes the controls we operate. Which of them apply in your environment depends on your licensing, your data, and your engagement scope, and we'll tell you exactly where things stand, in writing, before we start. Frameworks we align to ### Frameworks we align to We align our program to recognized security frameworks and document our controls against them. Where certification matters for your engagement, we'll tell you exactly where we stand, no overstating, no fine print. 1. **Aligned** ### NIST 800-53 / NIST CSF Our control set is mapped to NIST 800-53 and the NIST Cybersecurity Framework, captured in an internal self-assessment. This is a self-assessment, there is no third-party authorization (no ATO). 2. **Aligned** ### CIS Controls We use the CIS Controls as a practical hardening baseline for endpoints, identity, and cloud configuration. 3. **Aligned** ### FTC Safeguards / GLBA For clients with financial-data obligations, we align controls to the FTC Safeguards Rule and GLBA expectations. 4. **Aligned** ### HIPAA For covered engagements, we put a Business Associate Agreement (BAA) in place and align safeguards to HIPAA where required. 5. **Roadmap** ### SOC 2 On our roadmap. We're building toward SOC 2 Type II and operate audit-ready, but we are **not yet SOC 2 certified**, and we won't claim otherwise. 6. **Roadmap** ### CMMC On our roadmap toward CMMC Level 2 for future federal-adjacent work. We are **not CMMC certified or authorized** today; a 3PAO assessment happens when real federal work warrants it. We align to these frameworks and document our controls; where certification matters for your engagement, we'll tell you exactly where we stand. The controls we operate Data protection ### How your data is classified and protected Data protection starts with knowing what data you have, where it lives, and who can touch it, then encrypting it everywhere, at rest and in transit. 1. **Classification** ### Microsoft Purview Sensitivity labels applied across Microsoft 365, automated and AI-assisted classification, and Data Loss Prevention (DLP) policies that stop sensitive data from leaving where it shouldn't. 2. **Encryption** ### AES-256 + TLS 1.2+ AES-256 encryption at rest and TLS 1.2+ enforced in transit. Secrets and keys are held in Azure Key Vault with soft-delete protection, never in code or config. 3. **Tiering** ### Data classification tiers Data is classified across four tiers, Public, Internal, Confidential, and Restricted, so handling, access, and retention rules match sensitivity. Detection & response ### We watch, around the clock Detection and response is where security stops being a checklist and starts being a discipline. We run Microsoft's detection stack with 24/7 eyes and documented runbooks. 1. **XDR** ### Microsoft Defender XDR Defender for Endpoint, Defender for Identity, and Defender for Office 365 working together to detect threats across endpoints, identities, and email. 2. **SIEM** ### Microsoft Sentinel Sentinel SIEM correlates signals across the environment, surfacing real incidents from the noise instead of piling up disconnected alerts. 3. **Monitoring** ### 24/7 monitoring + audit logging Around-the-clock monitoring with comprehensive audit logging, so activity is recorded and reviewable, nights, weekends, and holidays included. 4. **Response** ### Incident response plan + runbooks A documented incident-response plan with runbooks and a designed 15-minute acknowledge target, so a detection turns into a coordinated response, not a scramble. - AES-256Encryption at restTLS 1.2+ enforced in transit - 24/7Monitoring coveragewith audit logging - 15 minDesigned acknowledge targetdocumented IR runbooks - XDRDefender Endpoint · Identity · O365+ Sentinel SIEM Resilience ### Built to survive ransomware Encryption keeps data private; resilience keeps the business running when something goes wrong. We design for recoverability, not just backup. 1. **Backup & DR** ### Documented RTO / RPO Backup and disaster-recovery design with documented Recovery Time and Recovery Point Objectives, so recovery expectations are defined up front, not discovered during an incident. 2. **Immutability** ### Immutable & point-in-time backups Immutable, point-in-time backups so an attacker who deletes or encrypts live data can't reach the recovery copy. 3. **Survivability** ### Ransomware survivability focus Recovery is designed around the reality that attackers target backups first, the goal is a recoverable event, not a business-ending one. 4. **Tested** ### Tested-recovery discipline Recovery is tested, not assumed, a backup you've never restored is a hope, not a plan. Access & governance ### Least privilege, by default The strongest control surface is identity. We run on Microsoft Entra ID with MFA enforced, least-privilege access, and no standing admin keys lying around. 1. **Identity** ### Entra ID + MFA enforced Microsoft Entra ID with multi-factor authentication enforced, identity is the front door, and it stays locked. 2. **RBAC** ### Least-privilege RBAC Role-based access control scoped to least privilege, so people and services hold only the access the job actually needs. 3. **JIT** ### Just-in-time admin access Just-in-time admin elevation with no standing SSH access, privileged access is granted when needed and removed when done. 4. **Passwordless** ### Managed identities Passwordless managed identities for service-to-service auth, removing long-lived credentials from the attack surface. 5. **Policies** ### 30 documented control policies 30 documented control policies mapped to NIST 800-53, written, versioned, and reviewable rather than tribal knowledge. 6. **Supply chain** ### Subprocessor vetting Supply-chain and subprocessor vetting with Data Processing Agreements (DPAs) and no-train terms, so your data isn't used to train third-party models. Network ### Locked at the edge Traffic is filtered before it reaches anything that matters, and backends are never exposed directly to the open internet. 1. **WAF** ### Azure Front Door WAF Azure Front Door Web Application Firewall running in prevention mode, blocking common web attacks at the edge. 2. **Origin lock** ### Origin-locked backends Backends are origin-locked so they only accept traffic from the WAF, not direct connections from the internet. 3. **DDoS** ### DDoS protection DDoS protection absorbs volumetric attacks before they reach the application layer. 4. **HTTPS-only** ### HTTPS-only HTTPS-only enforcement end to end, no plaintext traffic, ever. Honest accounting ## What we have. What we're building. Trust is built on candor. Here is exactly what's operating today versus what's on the roadmap, no inflation. What we have ### Operating today - Microsoft 365 E5, Defender, Purview, Sentinel, DLP - AES-256 at rest + TLS 1.2+ in transit - 30 documented control policies (NIST 800-53) - Incident-response plan + runbooks - 24/7 monitoring with audit logging - Backup & disaster recovery - Just-in-time admin access - Supply-chain / subprocessor vetting What we're building ### On the roadmap - SOC 2 Type II, audit-ready, not yet certified - CMMC Level 2, roadmap for federal-adjacent work - Third-party (3PAO) assessment, when federal work is real - Expanded conditional-access policies We are not certified for SOC 2, ISO 27001, FedRAMP, or CMMC. Our framework alignment is captured in an internal self-assessment with no ATO and no third-party (3PAO) audit. When that changes, this page will say so. Questions, answered ## Frequently asked Are you SOC 2 certified? Not yet. We're building toward SOC 2 Type II and we operate audit-ready, our controls are documented and mapped, but we are not SOC 2 certified, and we won't claim to be. If certification matters for your engagement, ask and we'll tell you exactly where we stand and what our timeline looks like. Is my data encrypted? Yes. Data is encrypted with AES-256 at rest and protected with TLS 1.2+ in transit. Secrets and keys live in Azure Key Vault with soft-delete, never in code or configuration. Do you use Microsoft Purview? Yes. We use Microsoft Purview for sensitivity labels, automated and AI-assisted classification, and Data Loss Prevention (DLP) policies across Microsoft 365. Can I get a security questionnaire or DPA? Yes. Email security@itraven.net and we'll complete your security questionnaire and provide a Data Processing Agreement (DPA), including our no-train terms for any subprocessors. How fast do you respond to incidents? We operate to a designed 15-minute acknowledge target backed by a documented incident-response plan and runbooks, with 24/7 monitoring so off-hours incidents don't sit unseen. ## Want to see where you stand? Start with a free security evaluation. We'll map your real exposure and show you exactly where your controls are strong and where the gaps are, with no obligation. Have a questionnaire, a DPA, or a hard security question? Reach us directly. [Get a free security evaluation](https://itraven.net/assessments?hsLang=en)[security@itraven.net](mailto:security@itraven.net) IT Raven [![IT Raven](https://itraven.net/hubfs/itraven-site/brand2/itraven-lockup-inverse-2x.png)](https://itraven.net/?hsLang=en) IT Raven LLC is a security-first, vendor-neutral IT partner. We plan and run networks, cloud, voice and security for mid-market companies, sourced through a 500+ partner network. [IT Raven on LinkedIn](https://www.linkedin.com/company/it-raven) [IT Raven on Facebook](https://www.facebook.com/profile.php?id=61595243603919) [IT Raven on Instagram](https://www.instagram.com/itravenllc/) [IT Raven on X](https://x.com/itravenllc) [IT Raven on YouTube](https://www.youtube.com/@itravenllc) ### Quick Links - [About](https://itraven.net/about-us) - [Solutions](https://itraven.net/solutions) - [Contact](https://itraven.net/contact-us) - [Blog](https://itraven.net/blogs) ###### Get In Touch ![contact](https://itraven.net/hubfs/raw_assets/public/@marketplace/MakeWebBetter/Academia/images/icons/phone-blue.svg) (620) 487-2836 ![Envelope](https://itraven.net/hubfs/raw_assets/public/@marketplace/MakeWebBetter/Academia/images/icons/envelope-blue.svg) info@itraven.net ![map](https://itraven.net/hubfs/raw_assets/public/@marketplace/MakeWebBetter/Academia/images/icons/location-blue.svg) Baltimore, MD (East) ![map](https://itraven.net/hubfs/raw_assets/public/@marketplace/MakeWebBetter/Academia/images/icons/location-blue.svg) Oklahoma City, OK (West) Copyright © 2026 IT Raven LLC. All rights reserved. [Privacy Policy |](https://itraven.net/privacy-policy?hsLang=en) [Terms and Conditions](https://itraven.net/terms-condition?hsLang=en) ```json { "@context" : "https://schema.org", "@id" : "https://itraven.net/#org", "@type" : "Organization", "areaServed" : [ "Maryland", "Oklahoma" ], "contactPoint" : { "@type" : "ContactPoint", "contactType" : "sales", "email" : "info@itraven.net", "telephone" : "+1-620-487-2836" }, "description" : "Security-first, vendor-neutral managed IT provider.", "logo" : "https://itraven.net/hubfs/itraven-site/brand2/itraven-lockup-2x.png", "name" : "IT Raven", "sameAs" : [ "https://www.linkedin.com/company/it-raven", "https://www.youtube.com/@itravenllc", "https://x.com/itravenllc", "https://www.facebook.com/profile.php?id=61595243603919", "https://www.instagram.com/itravenllc/" ], "url" : "https://itraven.net" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://itraven.net/", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://itraven.net/trust-center", "name" : "Trust Center", "position" : 2 } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Not yet. We're building toward SOC 2 Type II and we operate audit-ready, our controls are documented and mapped, but we are not SOC 2 certified, and we won't claim to be. If certification matters for your engagement, ask and we'll tell you exactly where we stand and what our timeline looks like." }, "name" : "Are you SOC 2 certified?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. Data is encrypted with AES-256 at rest and protected with TLS 1.2+ in transit. Secrets and keys live in Azure Key Vault with soft-delete, never in code or configuration." }, "name" : "Is my data encrypted?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. We use Microsoft Purview for sensitivity labels, automated and AI-assisted classification, and Data Loss Prevention (DLP) policies across Microsoft 365." }, "name" : "Do you use Microsoft Purview?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. Email security@itraven.net and we'll complete your security questionnaire and provide a Data Processing Agreement (DPA), including our no-train terms for any subprocessors." }, "name" : "Can I get a security questionnaire or DPA?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "We operate to a designed 15-minute acknowledge target backed by a documented incident-response plan and runbooks, with 24/7 monitoring so off-hours incidents don't sit unseen." }, "name" : "How fast do you respond to incidents?" } ] } ```