At onboarding and annually thereafter, management reviews service provider or vendor SOC 2 reports to assess scope appropriateness, the impact of identified exceptions, and applicable complementary user entity controls.

At the time of onboarding and on an annual basis

— Pyrana Vendor Management Policy.pdf

management performs reviews of SOC 2 reports from service providers/vendors

— Pyrana Vendor Management Policy.pdf

to review the appropriateness of scope

— Pyrana Vendor Management Policy.pdf

impact of identified exceptions, and applicable complementary user entity controls

— Pyrana Vendor Management Policy.pdf