---
title: 'Digital Future Group''s Information Security Program'
description: 'Digital Future Group''s information security program enforces every requirement of a client account''s security perimeter technically.'
url: 'https://dfuture.co/information-security-program/'
type: 'page'
typeLabel: 'Page'
language: 'en'
date: '2026-10-14'
updated: '2026-10-14'
---

# Digital Future Group's Information Security Program

> Digital Future Group's information security program enforces every requirement of a client account's security perimeter technically.

## Digital Future Group's Information Security Program

For a development vendor with access to your systems

## The questionnaire gap

A questionnaire answer is, by construction, a self-report as of the date it was filled in. It tells the buyer what the vendor says its program does. It does not, on its own, tell the buyer:

## How to verify Digital Future Group

## SOC 2 and HITRUST

## Four stages of access

- **Before access is granted**
- **During the engagement**
- **When something goes wrong**
- **When the relationship ends**

## Vendor evaluation table

The same four stages apply to any development vendor. The table below restates the lifecycle as a set of questions a buyer can put directly to a vendor, alongside the distinction, at each stage, between an answer that describes a policy and an answer that describes an enforced, evidenced control.

## Beyond the stages

- **Confidentiality and access discipline**
- **Security training**
- **Client software on a delivery device**
- **Mobile devices**
- **Discipline**

## Questions about SOC 2 and HITRUST

A buyer evaluating a development vendor will almost always encounter SOC 2 and HITRUST in some form, and the two are worth understanding on their own terms before asking any vendor about either.

- **What does a SOC 2 report cover?** — SOC 2 is built on the Trust Services Criteria published by the AICPA's Assurance Services Executive Committee, covering five categories: security, availability, processing integrity, confidentiality, and privacy. The security category alone spans control environment, risk assessment, monitoring, logical and physical access, system operations, change management, and risk mitigation. That is exactly the set of questions a buyer should already be asking a development vendor directly, with or without a SOC 2 report in hand.
- **What should I ask a vendor that cites SOC 2?** — The question a buyer can ask a vendor is not "what does your website say about SOC 2" but "may I see the report" — and, once it is in hand, "what does the exceptions section say, and what was the audit period."
- **What forms does a HITRUST result take?** — HITRUST results come in three forms — e1 (essentials, one-year validity), i1 (one-year validity), and r2 (the deepest, risk-based assessment, two-year validity). The external assessment and HITRUST's quality review are what stand behind a result; a readiness self-assessment against the framework is an internal preparation step ahead of that process.
- **What should I ask a vendor that cites HITRUST?** — For HITRUST, the equivalent question is "which of the three assessment types, and when does it expire."

## Continue reading

- ****
- ****

## Check the program yourself

Read the full document. If you need the evidence behind it, request a security review under NDA.

## Get the full document



## Subscription Form get the full doc

Форма на странице: Work email (обязательно), Also request a security review under NDA (optional). Отправка доступна в HTML-версии: https://dfuture.co/information-security-program/

---
HTML: https://dfuture.co/information-security-program/
Markdown: https://dfuture.co/information-security-program.md