Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 164 posts

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#41

Post by crote »

sochix wrote: post #19
rozumbrada wrote: post #12

Not possible in case your clients are not stupid. Any company with SOC2 and You might find auditors that would go along but any reasonable client will check your SOC2 report and quality of your auditors. SOC2 requires tons of paperwork and management and separation of duties with also mandatory roles in your company - never feasible in a one man show.

So that means that solo-entrepreneurs can't sell apps to big enterprises due to SOC2 limitation? I think that it is not fair

Like it or not, having a bus factor of 1 is a pretty big risk. You are a giant single-point-of-failure, which means that operations-wise you are a far riskier option to your customers than a significantly larger competitor.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#43

Post by apimade »

I’ll spend some more time replying to this next week, so circle back to this comment; I’m someone who regularly helps people get past these audits, meet the criteria customers are trying to assess with these certifications, and vet startups who don’t have these certifications or budget.

Start by pre-filling your own CAIQ v4 with an earnest “we don’t do this” or “we haven’t even thought about this” attempt: https://cloudsecurityalliance.org/artifacts/cloud-controls-m...

Then read through it and see what you can address immediately (EDR on your laptop, MFA on your cloud environments, etc), followed by role playing your client; “based on answers to this questionnaire, what would I not accept?”

There will be some items you can’t fix.

You’ll soon find out the majority of customers, including banks, governments, defence contractors, crypto startups — simply do not care. If they want to use your product, they’ll work with you.

It may be single-tenancy, it may require architectural changes, it may mean making it selfhosted with a time-bomb, but you’ll be able to address the requirements of the CISO, compliance monkey or executive.

I’ve yet to meet an industry or individual I can’t convince. Even if the product is a hot mess, half baked and radioactive — we’ll deploy it on a VM running inside of a VDI within the customer’s environment, because slopping together a migration path is _so easy_, and those early, highly regulated clients are worth it.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#44

Post by sochix »

apimade wrote: post #43

I’ll spend some more time replying to this next week, so circle back to this comment; I’m someone who regularly helps people get past these audits, meet the criteria customers are trying to assess with these certifications, and vet startups who don’t have these certifications or budget. Start by pre-filling your own CAIQ v4 with an earnest “we don’t do this” or “we haven’t even thought about this” attempt: https://cl…

Thank you! That make a lot of sense!

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#45

Post by yread »

i2km wrote: post #32

Really appreciate this discussion as I'll be shortly going through this with a 1-2 person company. Does anyone have any experience on how it compares to ISO27001 from the 1-2 person company feasibility standpoint?

I'm in a similar position. The business continuity requirements are difficult to satisfy. And the amount of paperwork you need to do (depending on your policies of course) can be a major slow down for developing new stuff. So it's best to get your dev heavy stuff done before. I'm just filling in the questionnaires instead for now (and losing some customers who would be too big anyway)

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#46

Post by tclancy »

pugdogdev wrote: post #8

As others suggested, as a solo entrepreneur, I recommend not entering this process without a real justification. I passed this SOC 2 type for my startup after securing a deal with a big client. SOC 2 is an ongoing process that involves many documents and workflows you will need to implement in your company. If your clients really insist on proof of security compliance, I will try to find a local PT authority to compl…

PT?

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#47

Post by whitefang »

_tk_ wrote: post #31

I was part of several third party risk management audits from a corporate perspective. We regularly audited and questioned SMBs (and big corps) with regards to their security posture. We knew that small shops wouldn’t be able to be fully compliant to SOC2 Type 2 or have an ISO27001 certified environment. If it was clear that our business wanted the product, we either tried to help the company with the questionnaire o…

Can this also be done for HIPAA and FERPA, or for those compliance requirements is the process the way to go and just filling out the questionnaire would not be sufficient?

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#48

Post by pugdogdev »

tclancy wrote: post #46
pugdogdev wrote: post #8

As others suggested, as a solo entrepreneur, I recommend not entering this process without a real justification. I passed this SOC 2 type for my startup after securing a deal with a big client. SOC 2 is an ongoing process that involves many documents and workflows you will need to implement in your company. If your clients really insist on proof of security compliance, I will try to find a local PT authority to compl…

PT?

penetration testing

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#49

Post by apimade »

sochix wrote: post #44
apimade wrote: post #43

I’ll spend some more time replying to this next week, so circle back to this comment; I’m someone who regularly helps people get past these audits, meet the criteria customers are trying to assess with these certifications, and vet startups who don’t have these certifications or budget. Start by pre-filling your own CAIQ v4 with an earnest “we don’t do this” or “we haven’t even thought about this” attempt: https://cl…

Thank you! That make a lot of sense!

No worries, it’s more about finding what the security and compliance teams care about — and making them comfortable. Compliance doesn’t equal security, I’ve onboarded startups with better security than the SOC2 certified, ISO27K Swiss cheese $B unicorn.

Hackers don’t target based on certification. It’s generally convenience and motive. Unknown startups who are laying solid foundations won’t show up on anyone’s radar for the first 2 years without some insanely unlucky event (i.e supply chain breach, an early employee doing something really dumb).

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#50

Post by p_l »

apimade wrote: post #43

I’ll spend some more time replying to this next week, so circle back to this comment; I’m someone who regularly helps people get past these audits, meet the criteria customers are trying to assess with these certifications, and vet startups who don’t have these certifications or budget. Start by pre-filling your own CAIQ v4 with an earnest “we don’t do this” or “we haven’t even thought about this” attempt: https://cl…

Major problem of entire compliance/auditing industry is not enough asking in companies "what are the actual risks we are dealing with", "what's the goal for given control", "do we have alternative control ensuring that".

Compounded by cheap shitty auditors that just mark down checkboxes on a worksheet

Post reply on HN