Security and compliance your team can verify before you commit.
FactorySense has completed a SOC 2 Type 2 examination by Sensiba LLP and maintains a CMMC Level 2 self-assessment against NIST SP 800-171. Your security, IT, and procurement teams can review our controls, policies, and audit documentation directly in the FactorySense Trust Center.
Documented evidence for your vendor security review.
An industrial tracking system sits close to production records and enterprise systems. For many defense suppliers, those records include controlled unclassified information. We measure our security program against recognized frameworks and make the supporting evidence available to customers and prospects.
SOC 2 Type 2
Sensiba LLP, an independent CPA firm, examined the design of our security controls and tested how they operated over the audit period. The full report is available through our Trust Center.
CMMC Level 2
We have assessed our environment against the 110 security requirements of NIST SP 800-171, the basis of CMMC Level 2, and recorded the results in the Supplier Performance Risk System (SPRS).
Continuous control monitoring
Drata tests our controls automatically between audits and flags exceptions for remediation. The control status you see in our Trust Center stays current throughout the year.
Review our security program on your own schedule.
Our Trust Center, powered by Drata, gives your reviewers one place to see our security policies, current control status and compliance documentation. Request the SOC 2 Type 2 report there. If your review needs something the Trust Center does not cover, our team will provide it as part of the evaluation.
Prepared for the supplier requirements of defense programs.
Defense prime contractors increasingly flow DFARS cybersecurity requirements down to every supplier that touches program information, including the companies that deliver tracking systems. Our CMMC Level 2 self-assessment and SOC 2 Type 2 report give your compliance team documented answers early in the evaluation. FactorySense.io can be hosted in AWS GovCloud (US) when a program requires a US government cloud region. On-premises hosting is also available.
Consistent controls from the read point to your ERP.
An RFID deployment spans tags, readers, network connections, software, and the enterprise systems it updates. Because FactorySense delivers those layers as one program, one team is accountable for how data is protected across all of them.
RFID observations become operational events and enterprise records.
Encryption in transit and at rest
Customer data is encrypted as it moves between connected devices, FactorySense.io, and your integrations, and it remains encrypted in storage.
RFID observations become operational events and enterprise records.
Single sign-on and role-based access
FactorySense.io connects to your identity provider through single sign-on. Role-based permissions then determine who can view tracking data and who can change system configuration.
RFID observations become operational events and enterprise records.
Hosting options, including GovCloud and on-premises
Run FactorySense.io in our standard cloud environment, in AWS GovCloud (US) when a program requires a US government cloud region, or on your own premises or private cloud.
RFID observations become operational events and enterprise records.
Managed updates and monitoring
Hosted deployments receive security patches, system monitoring, and support from the same team that designed and installed them.
What security and procurement teams usually ask
If your review raises a question that is not covered here, our team will work through it with you.
How can we get the FactorySense SOC 2 Type 2 report?+
Request it through the FactorySense Trust Center. Because the report describes our control environment in detail, we share it under a nondisclosure agreement, which you can review and accept directly in the Trust Center.
Who performed the SOC 2 Type 2 examination?+
Sensiba LLP, an independent CPA firm. A Type 2 report evaluates whether controls operated effectively over a period of time. A Type 1 report only addresses how controls were designed at a single point in time.
What does a CMMC Level 2 self-assessment mean for our contract?+
CMMC Level 2 applies to organizations that handle controlled unclassified information and is based on the 110 security requirements in NIST SP 800-171. FactorySense has completed a self-assessment against those requirements and recorded the results in SPRS. Some contracts instead specify a Level 2 certification by an authorized third-party assessor (C3PAO), so confirm the level your solicitation requires and we will discuss how it applies.
Can FactorySense.io be hosted in AWS GovCloud (US)?+
Yes. Programs that require a US government cloud region can run FactorySense.io in AWS GovCloud (US). We confirm the hosting model, integrations, and support arrangements during project scoping.
Does an RFID system introduce new network security risks?+
Readers and gateways are network devices and should be managed like other operational technology on your site. During design, we work with your IT and security teams on network segmentation, device access, and the connections between the floor and FactorySense.io so that the deployment fits your existing policies.
Will you complete our vendor security questionnaire?+
Yes. Documentation in our Trust Center answers many common questions, and our team responds to the rest as part of your vendor review.
Bring your security requirements into the first conversation.
Tell us about your compliance obligations, hosting constraints, and review process. We will explain how FactorySense meets them and which documentation your team will need.