Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Startup CTO's Handbook

github.com

Post reply on HN
Print view View original

11–20 of 212 posts

Re: The Startup CTO's Handbook

#11

Post by bri3d »

gizmov21 wrote: post #6
tptacek wrote: post #3

One way I try to get my head around things like this is to skip to a section I understand deeply and see what they said. Here, the claim is made: Don't try to get a compliance certificate at the last minute. Preparing for and conducting an audit such as for PCI DSS or SOC 2 from start to finish is a lengthy process, ranging from six to twelve months for most startups. Starting early and maintaining compliance is chea…

Made an account just to say that I respectfully disagree solely when it comes to accounting and supply chain processes in an enterprise ERP. Unwinding un-auditable processes costs so much f’ing time and money while the business still has to run that I’ve found it to be cheaper and better to be auditable from day 1, in this one specific instance.

There’s being auditABLE and being auditED. Honestly I think the article’s take is smarter for a less experienced or skilled founding team and tptacek’s is better for a more experienced team. Paying auditors to look at screenshots and CSVs is a giant waste of money until it’s not, but at the same time, letting bad practice ossify until it’s expensive to remove is also a mistake.

Re: The Startup CTO's Handbook

#12

Post by tptacek »

whitepoplar wrote: post #9
tptacek wrote: post #3

One way I try to get my head around things like this is to skip to a section I understand deeply and see what they said. Here, the claim is made: Don't try to get a compliance certificate at the last minute. Preparing for and conducting an audit such as for PCI DSS or SOC 2 from start to finish is a lengthy process, ranging from six to twelve months for most startups. Starting early and maintaining compliance is chea…

Do you know of a good resource which describes these simple best practices?

I wrote two:

https://www.latacora.com/blog/2020/03/12/the-soc-starting/

https://fly.io/blog/soc2-the-screenshots-will-continue-until...

Re: The Startup CTO's Handbook

#13

Post by gizmov21 »

bri3d wrote: post #11
gizmov21 wrote: post #6

Earlier quoted context omitted.

Made an account just to say that I respectfully disagree solely when it comes to accounting and supply chain processes in an enterprise ERP. Unwinding un-auditable processes costs so much f’ing time and money while the business still has to run that I’ve found it to be cheaper and better to be auditable from day 1, in this one specific instance.

There’s being auditABLE and being auditED. Honestly I think the article’s take is smarter for a less experienced or skilled founding team and tptacek’s is better for a more experienced team. Paying auditors to look at screenshots and CSVs is a giant waste of money until it’s not, but at the same time, letting bad practice ossify until it’s expensive to remove is also a mistake.

Yea agreed, my comment was more of a sidenote than a direct response.

Re: The Startup CTO's Handbook

#14

Post by gizmov21 »

Tostino wrote: post #8
gizmov21 wrote: post #6

Earlier quoted context omitted.

Made an account just to say that I respectfully disagree solely when it comes to accounting and supply chain processes in an enterprise ERP. Unwinding un-auditable processes costs so much f’ing time and money while the business still has to run that I’ve found it to be cheaper and better to be auditable from day 1, in this one specific instance.

I built one of the Trade Promotion Management platforms used in the NA market, and couldn't agree more. It's a nightmare trying to be auditable if you didn't think about it from the start.

I was at (insert infamous unicorn) and they spent a ton of money (all relative, the money meant nothing) but more importantly 18 months attempting to get SOX compliant and never made it, because running the business was too important. Of course it all came down to lack of leadership to enforce policies but even if we had it, it was objectively super fucking challenging.

When I do get a chance to implement compliant processes at the beginning, it’s one of those amazing IT things where we prevent WW3 but never get the credit for it.

Re: The Startup CTO's Handbook

#15

Post by xyzzy_plugh »

tptacek wrote: post #3

One way I try to get my head around things like this is to skip to a section I understand deeply and see what they said. Here, the claim is made: Don't try to get a compliance certificate at the last minute. Preparing for and conducting an audit such as for PCI DSS or SOC 2 from start to finish is a lengthy process, ranging from six to twelve months for most startups. Starting early and maintaining compliance is chea…

> There are things you should start doing early that lay the groundwork for attestations, but you should be doing them anyways, even if you never plan to get a SOC2 (and if a big-ticket customer never demands it, you shouldn't SOC2). That's stuff like setting up single sign-on and having protected git branches; simple best practices.

This is in many ways the spirit of SOC2, no? There are a lot of startup founders, far more than I'd like, who would purposefully eschew such "simple best practices" unless they had an axe like a SOC2 audit swinging over them.

I think you're both right, for what it's worth, and my take is that you are more aligned with TFA than you perceive.

Re: The Startup CTO's Handbook

#16

Post by tptacek »

xyzzy_plugh wrote: post #15
tptacek wrote: post #3

One way I try to get my head around things like this is to skip to a section I understand deeply and see what they said. Here, the claim is made: Don't try to get a compliance certificate at the last minute. Preparing for and conducting an audit such as for PCI DSS or SOC 2 from start to finish is a lengthy process, ranging from six to twelve months for most startups. Starting early and maintaining compliance is chea…

> There are things you should start doing early that lay the groundwork for attestations, but you should be doing them anyways, even if you never plan to get a SOC2 (and if a big-ticket customer never demands it, you shouldn't SOC2). That's stuff like setting up single sign-on and having protected git branches; simple best practices. This is in many ways the spirit of SOC2, no? There are a lot of startup founders, fa…

How are we both right? I think you literally should wait until the last minute to start a SOC2 process.

Re: The Startup CTO's Handbook

#17

Post by rendaw »

tptacek wrote: post #16
xyzzy_plugh wrote: post #15

Earlier quoted context omitted.

> There are things you should start doing early that lay the groundwork for attestations, but you should be doing them anyways, even if you never plan to get a SOC2 (and if a big-ticket customer never demands it, you shouldn't SOC2). That's stuff like setting up single sign-on and having protected git branches; simple best practices. This is in many ways the spirit of SOC2, no? There are a lot of startup founders, fa…

How are we both right? I think you literally should wait until the last minute to start a SOC2 process.

GP's point is that having SSO and protected git branches _is_ starting the SOC2 process.

Re: The Startup CTO's Handbook

#18

Post by koolba »

rendaw wrote: post #17
tptacek wrote: post #16

Earlier quoted context omitted.

How are we both right? I think you literally should wait until the last minute to start a SOC2 process.

GP's point is that having SSO and protected git branches _is_ starting the SOC2 process.

That and having a ticket system (e.g., Jira) to track why you touched prod and you can answer just about every question.

Re: The Startup CTO's Handbook

#19

Post by tptacek »

rendaw wrote: post #17
tptacek wrote: post #16

Earlier quoted context omitted.

How are we both right? I think you literally should wait until the last minute to start a SOC2 process.

GP's point is that having SSO and protected git branches _is_ starting the SOC2 process.

I'm pretty sure that's not what the author meant. Again: those are things you should do regardless of whether you're ever going to get SOC2 (and a lot of startups shouldn't).

Re: The Startup CTO's Handbook

#20

Post by morsecodist »

tptacek wrote: post #3

One way I try to get my head around things like this is to skip to a section I understand deeply and see what they said. Here, the claim is made: Don't try to get a compliance certificate at the last minute. Preparing for and conducting an audit such as for PCI DSS or SOC 2 from start to finish is a lengthy process, ranging from six to twelve months for most startups. Starting early and maintaining compliance is chea…

I am new to compliance but this seems super strange to me. Based on my cursory read of SOC2 you need a ton of evidence gathering for months leading up to your audit. How wold you know what to retroactively have if you didn't spend time on it?

SOC2 attestations being easy to get also runs counter to what I have heard from every single other person on this topic. Generally what I hear is that it is extremely hard and time consuming. What am I missing? I would love to be wrong here and for this to be easy.

Post reply on HN