Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 164 posts

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#61

Post by tptacek »

flowerbreeze wrote: post #29

I've been through SOC 2 Type 2 in a company with ~100 people. I think it'd be in some ways simpler as a solopreneur, but still a lot of effort. You won't require as complex controls and you don't need to communicate between different parts of company, but it'll just be yourself doing it all. On a positive side, you won't have to do 100% of SOC 2 Type 2. The only required part is security if I remember correctly. And…

The only SOC2 anybody does is security and if your auditor tries to convince you that you need the other profiles they're rolling you.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#62

Post by yeutterg »

tptacek wrote: post #57

Don't. You are exactly the wrong kind of firm to be pursuing SOC2. SOC2 is like the corporate GPL of security. It's an infectious secret handshake company security teams swap in lieu of filling out security questionnaires. Nobody savvy takes it seriously. There will come a time where your business will grow to the point where it makes sense to pay for the secret handshake. The overwhelming most likely scenario in whi…

Plus, even when you have SOC2 (+pen test, +ISO 27001), you'll still have to fill out questionnaires!

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#63

Post by tptacek »

Keyframe wrote: post #13

I went through the process and while it seems it's daunting, it's just a bunch of work and some cash. Once established it's also transformative (or should be) on your ongoing processes and practices. You codify those into a bunch of documents (jesus, that's a lot of documents type of thing) and provide evidence for each; Auditors latch onto those randomly. It's then your job to upkeep documents and evidence which can…

I can't say enough how not transformative SOC2 should be on your processes. Near-automatic exception-free attestations should be a byproduct of basic sane corpsec practices. SOC2 should never be leading or informing your security practices.

For people who don't know much about SOC2, the headline is that all SOC2 does is confirm that you do the things you say you do. There's a short vibes-based catalog of objectives --- things like "change management" and "access control" and "backups" --- but no actual standard on how any of those things are done. The controls you use to meet those objectives could be $50,000/yr enterprise software packages, or they could be a system of post-it notes. Your auditor does not care, so long as the things you say you do, you do consistently.

What happens all too often is that companies come into this process (usually ill-advisedly; probably as many as half the SOC2-attested firms don't really need to be) without clear objectives and security practices to begin with. They read the SOC2 DRL, reconcile it with what they are and aren't doing in IT already, and end up instituting whatever the "default" controls look like for each objective, which is how you end up with AWS SAAS startups running network intrusion detection in 2026.

I wrote a post 6 years ago for my clients who were ideating getting SOC2; it's about the (very small and very simple) set of engineering things you need to do to be in a place where you'll get an automatic SOC2 Type I attestation. It has held up very well. You should understand everything in this post well enough to have opinionated takes on everything in a SOC2 DRL, and to be in a position to tell your auditors to GTFO if they ask you to do more.

https://www.latacora.com/blog/2020/03/12/soc2-starting-seven...

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#65

Post by nickjj »

You could look at the process itself and apply the things that sound good to you. It won't help with official certificates but you can start replying back saying you adhere to certain things that are suggested by SOC 2 Type 2.

I can also say that being SOC 2 Type 2 compliant doesn't come even remotely close to demonstrating that you can be trusted. That's not a knock on you or your work ethic, but there's tons of ways for things to go wrong or get leaked while still being SOC 2 Type 2 certificated.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#66

Post by teeklp »

frenkel wrote: post #55
crote wrote: post #36

I'm currently at a small startup trying to do ISO 27001. A big issue we run into is that there simply aren't enough people . For example, the processes are built around having one person who writes code, and another person who reviews the written code. That's obviously impossible as a solo dev. You also need an internal auditor, who obviously needs to be separate from the operations team. If I recall correctly the mi…

We are a team of 1 developer and 1 sales/marketing and are fully certified. You can hire an external auditor for the internal audit. We have AI code reviews, so we don’t need an extra developer.

lol

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#67

Post by tptacek »

nickjj wrote: post #65

You could look at the process itself and apply the things that sound good to you. It won't help with official certificates but you can start replying back saying you adhere to certain things that are suggested by SOC 2 Type 2. I can also say that being SOC 2 Type 2 compliant doesn't come even remotely close to demonstrating that you can be trusted. That's not a knock on you or your work ethic, but there's tons of way…

A "SOC2 Type II" is just a repeated Type I audit where they make sure you haven't regressed anything. It doesn't make sense to use the definite article "the" with SOC2: everybody's SOC2 is different.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#68

Post by maximilianburke »

crote wrote: post #36

I'm currently at a small startup trying to do ISO 27001. A big issue we run into is that there simply aren't enough people . For example, the processes are built around having one person who writes code, and another person who reviews the written code. That's obviously impossible as a solo dev. You also need an internal auditor, who obviously needs to be separate from the operations team. If I recall correctly the mi…

We've been ISO 27k certified for years now. ISO 27001 relies heavily on risk documentation and mitigation; you can get around the separation-of-roles by calling them out as individual risks and making sure the appropriate authority signs off on them (ie: have an email from the CEO saying "I delegate Bob to create policies and sign off on them, and also perform our internal audits. I recognize the risks this creates but due to our size we accept them at this time.")

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#70

Post by Keyframe »

tptacek wrote: post #63
Keyframe wrote: post #13

I went through the process and while it seems it's daunting, it's just a bunch of work and some cash. Once established it's also transformative (or should be) on your ongoing processes and practices. You codify those into a bunch of documents (jesus, that's a lot of documents type of thing) and provide evidence for each; Auditors latch onto those randomly. It's then your job to upkeep documents and evidence which can…

I can't say enough how not transformative SOC2 should be on your processes. Near-automatic exception-free attestations should be a byproduct of basic sane corpsec practices. SOC2 should never be leading or informing your security practices. For people who don't know much about SOC2, the headline is that all SOC2 does is confirm that you do the things you say you do. There's a short vibes-based catalog of objectives -…

Near-automatic exception-free attestations should be a byproduct of basic sane corpsec practices.

being key here. if you realize it's not all that sane when you start reviewing things, what happened in our case was it allowed us (there were other signals as well) to regroup on our practices and then it was painless.

Post reply on HN