[flagged]
Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?
131–140 of 164 posts
Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?
#132Don't. You are exactly the wrong kind of firm to be pursuing SOC2. SOC2 is like the corporate GPL of security. It's an infectious secret handshake company security teams swap in lieu of filling out security questionnaires. Nobody savvy takes it seriously. There will come a time where your business will grow to the point where it makes sense to pay for the secret handshake. The overwhelming most likely scenario in whi…
I will add a few more things to this: - Document your data and security and share that with customers instead. You can say "We don't have SOC2 at the moment but here is all our security and data policy". It works 99% of the time for me. - Very few companies truly have policy to reject a vendor if they don't have SOC2. Those are usually large enterprise or companies in sensitive areas such as Finance/Healthcare etc. E…
An extra comment, from someone in an organisation that faced this recently, on dealing with this:
- Be outside the US. "SOC2 is an AICPA certification that is unavailable in this country".
Not sure whether that's actually 100% accurate but they stopped asking after this.
Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?
#133Earlier quoted context omitted.
> in lieu of filling out security questionnaires. Isn't that no longer an issue in AI era?
Do you want to trust your company's legal commitment on the output of modern LLMs?
"Move fast and break things" applies even more in business than in software. If you get the revenue and don't suffer a legal penalty, you win. I've worked at companies that didn't outright fake their certifications, but definitely didn't care about following them and just did whatever was needed for the customer to pay up. In fact I'd say that's most companies. This is not a compiler you have to pass, it's a game you play with your customers.
Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?
#134I am a solo entrepreneur. Don't. I learned that my business is unable to pass pretty much ANY certification or corporate IT security audit. Many of the questions simply do not apply to my business ("do you have documented procedures for revoking employee access") and the default answer is NO. Get even a single NO and you're done. I gave up and these days actively discourage enterprises from even trying to sign up — t…
> do you have documented procedures for revoking employee access
The answer should be "yes". And here you just drafted one.
That's the point of going through SOC2. You make policies that you don't have and execute the policies for some amount of time to pass SOC2.
Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?
#135[flagged]
Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?
#136Earlier quoted context omitted.
Can this also be done for HIPAA and FERPA, or for those compliance requirements is the process the way to go and just filling out the questionnaire would not be sufficient?
SOC2 is, at the end of the day, a voluntary compliance standard. HIPAA and FERPA requirements are federal law. Waiving those requirements would not just mean accepting additional liability, but would normally make your customer ineligible to receive federal funds, which are typically a substantial chunk of revenue.
You have it completely the wrong way around.
HIPAA is self-certifying, SOC2 isn't.
No way on earth you are getting SOC2 without an auditor.
Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?
#137Yes, its very possible.
What's most important for you would just being able to prove to your customers that you do what you say you do.
The core issue isn't SOC 2, it's verifiability. Your customers want to know that what you claim about your security posture is actually true, not just documented.
I've actually been deeply exploring the compliance space lately and a few days ago I built an open-core pre-audit readiness layer. Every finding traces back to the raw AWS API call that produced it, SHA-256 hashed. An auditor or skeptical customer can verify it themselves without taking your word for it.
Its more SOC 2-esque, & its pre-audit readiness not a certification, but it does the job of proving you are trustworthy.
repo if relevant: https://github.com/adog0822/AWS-Evidence-Layer
(I built this, disclosing upfront)
Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?
#138Earlier quoted context omitted.
Major problem of entire compliance/auditing industry is not enough asking in companies "what are the actual risks we are dealing with", "what's the goal for given control", "do we have alternative control ensuring that". Compounded by cheap shitty auditors that just mark down checkboxes on a worksheet
Agree, see the Delve fiasco. But that’s not their job. Their job is literally checkbox. However some audits are so poorly done, or have auditors with zero real world engineering or cyber experience, they’re actively harmful to a product or customer base. Example: insane, complex password policies and password rotation policies. These are still pushed by auditors rather than trying to build a reasonable exception case…
I was thinking more of audits that do not even allow deviation nor have any understanding what they are asking for each checkbox. So it's hard to even start on anything nuanced.
Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?
#139Has no one yet found a way to vibe-code this into a viable self-service solution? and yes I do understand there is a IRL-auditing authority piece to all of this too. Perhaps there this is a play here in the market to create a new auditing firm that 99% automates all this for startups? sans fraud certs of course.
[flagged]
Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?
#140Not possible in case your clients are not stupid. Any company with SOC2 and You might find auditors that would go along but any reasonable client will check your SOC2 report and quality of your auditors. SOC2 requires tons of paperwork and management and separation of duties with also mandatory roles in your company - never feasible in a one man show.
So that means that solo-entrepreneurs can't sell apps to big enterprises due to SOC2 limitation? I think that it is not fair
As the other respondent says, it's tricky but not impossible. We're a small custom shop, too small to have all the roles required, all of our software is open-source (Github/Codeberg), and we neither store nor process any customer data or PII. Almost every single item that SOC2 and similar are supposed to cover are a bad miss - https://www.youtube.com/watch?v=Utxu7pI8CeU. Not only do most things not apply to us but some are completely nonsensical, such as what physical and IT security measures we apply to keep our code confidential.
At the moment things look a bit uncertain, we're both going to run into more and more situations like this but also hopefully lawmakers will eventually realise that this stuff just doesn't work for OSS code and orgs.