Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 164 posts

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#121

Post by codegeek »

parliament32 wrote: post #92
codegeek wrote: post #85

Earlier quoted context omitted.

I will add a few more things to this: - Document your data and security and share that with customers instead. You can say "We don't have SOC2 at the moment but here is all our security and data policy". It works 99% of the time for me. - Very few companies truly have policy to reject a vendor if they don't have SOC2. Those are usually large enterprise or companies in sensitive areas such as Finance/Healthcare etc. E…

> It works 99% of the time I would add the caveat "...as long as you have no competition." If you're in a market where alternatives exist, and they have the certification, you're definitely transparently losing sales. From the enterprise side, I can tell you vendor certification takes an order of magnitude more time/money/effort when the vendor says "we don't have cert X but here's a mountain of drivel you can paw th…

It depends on your target market. If you only sell to enterprise/large companies, you may need SOC2 sooner than later. If you sell to SMBs or startups, this advice works (I sell in this space mostly).

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#122

Post by ErrantX »

tortilla wrote: post #115
ErrantX wrote: post #107

Earlier quoted context omitted.

Your getting that interest because it looks like a steal. Ultimately those businesses couldn't care less about $50/m (except to chance it) but they want - or even need - the enterprise terms. They will pay $50 for your product... And probably $950 for the terms. (Not saying that would have been the right thing for you but my advice to folks who find themselves in this position is always 20x or 40x the price - if that…

My plans start at $50. Top out at $10k a month.

Obviously I know nothing about your product, so completely uninformed!

But as an enterprise buyer $50/m and $10K/m is the same bucket in terms of cost. No one will blink until around 100K, depending on what it is.

(The point I am making is; as an enterprise buyer I absolutely know how annoying it is for me to turn up and go "this random regulation, we're interpreting it in this highly specific and unique way, and we want it asap". Hence willingness to pay down that inconvenience)

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#123

Post by xyzzy123 »

maximilianburke wrote: post #68
crote wrote: post #36

I'm currently at a small startup trying to do ISO 27001. A big issue we run into is that there simply aren't enough people . For example, the processes are built around having one person who writes code, and another person who reviews the written code. That's obviously impossible as a solo dev. You also need an internal auditor, who obviously needs to be separate from the operations team. If I recall correctly the mi…

We've been ISO 27k certified for years now. ISO 27001 relies heavily on risk documentation and mitigation; you can get around the separation-of-roles by calling them out as individual risks and making sure the appropriate authority signs off on them (ie: have an email from the CEO saying "I delegate Bob to create policies and sign off on them, and also perform our internal audits. I recognize the risks this creates b…

Right but at n=1 you are writing the policies, reviewing them, signing off on them yourself, raising risks, then ducking out the back and running out again with a fake mustache so you can accept the risks you raised... regarding yourself... lol.

Audits rely on a _certain_ amount of ceremony and theatre.

However, since you typically pay for audits / certifications yourself you might find someone who is willing to entertain the charade if you shop around enough. Probably a solo auditing firm :)

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#125

Post by icedchai »

tptacek wrote: post #87
browningstreet wrote: post #84

Earlier quoted context omitted.

It's all negotiable. I did audits and attestations at a bank, .. everything's negotiable. > that implies that they don't understand SOC2 Good engineering and SOC2 compliance can be on similar but not identical paths. If you want SOC2, you're bending your engineering towards that particular standard. Getting SOC2 compliant because it's time, and you have the customers, is just a step, and not a reflection of whatever…

I wrote at length downthread about how much engineering absolutely should not be bending towards SOC2; it's the opposite. https://news.ycombinator.com/item?id=48150405

I've been working with an organization that apparently won't give its developers reasonable access to dev cloud environments "because of SOC2." At least, that is the excuse they tell me.

Example: "I need access to EC2" isn't enough. I wind up with a role where I can launch instances, but not list them. I have to send several emails, have meetings, follow ups, sending links to AWS docs, etc. to get them to modify a custom IAM role. Then they still can't figure it out, so I am literally telling someone what to copy-and-paste into JSON to fix the issue. I completely understand more control in higher environments, but this crap adds up and costs weeks in lost productivity.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#126

Post by tptacek »

icedchai wrote: post #125
tptacek wrote: post #87

Earlier quoted context omitted.

I wrote at length downthread about how much engineering absolutely should not be bending towards SOC2; it's the opposite. https://news.ycombinator.com/item?id=48150405

I've been working with an organization that apparently won't give its developers reasonable access to dev cloud environments "because of SOC2." At least, that is the excuse they tell me. Example: "I need access to EC2" isn't enough. I wind up with a role where I can launch instances, but not list them. I have to send several emails, have meetings, follow ups, sending links to AWS docs, etc. to get them to modify a cu…

Oh, absolutely, security and compliance teams have for over a decade been exploiting SOC2 to exert undue control over engineering process.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#127

Post by awesomeusername »

_se wrote: post #101
frenkel wrote: post #55

Earlier quoted context omitted.

We are a team of 1 developer and 1 sales/marketing and are fully certified. You can hire an external auditor for the internal audit. We have AI code reviews, so we don’t need an extra developer.

Anyone who certified you with AI code reviews is a moron.

Ironic

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#128

Post by bdangubic »

frenkel wrote: post #55
crote wrote: post #36

I'm currently at a small startup trying to do ISO 27001. A big issue we run into is that there simply aren't enough people . For example, the processes are built around having one person who writes code, and another person who reviews the written code. That's obviously impossible as a solo dev. You also need an internal auditor, who obviously needs to be separate from the operations team. If I recall correctly the mi…

We are a team of 1 developer and 1 sales/marketing and are fully certified. You can hire an external auditor for the internal audit. We have AI code reviews, so we don’t need an extra developer.

> We have AI code reviews, so we don’t need an extra developer.

You can streamline this and remove the developer as well and then of course you can streamline this even further and remove the sales/marketing person and just have AI run it all :)

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#129

Post by hughw »

It's easier than you might think. Not easy! But I've done it. Have Fortune As others point out if you don't show your audit you have to affirm that you basically do everything an audit would check. So, do it.

I found Thoropass to be offer a deal that was affordable. You're not too small for them. Check them out.

You can form your processes any way you want! Use AI to construct your policies. Just document what you do.

I spent a probably 5 hours a month the first year. Learning curve and I felt I needed the hand holding from Thoropass... they were generous with time and explanations. Subsequent years, it's all set up, very little until audit time.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#130

Post by icedchai »

tptacek wrote: post #126
icedchai wrote: post #125

Earlier quoted context omitted.

I've been working with an organization that apparently won't give its developers reasonable access to dev cloud environments "because of SOC2." At least, that is the excuse they tell me. Example: "I need access to EC2" isn't enough. I wind up with a role where I can launch instances, but not list them. I have to send several emails, have meetings, follow ups, sending links to AWS docs, etc. to get them to modify a cu…

Oh, absolutely, security and compliance teams have for over a decade been exploiting SOC2 to exert undue control over engineering process.

Yep! It took a month of back-and-forth to do what should have taken less than a day in an environment with less friction. I'm totally frustrated by the project at this point.
Post reply on HN