Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 164 posts

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#31

Post by _tk_ »

I was part of several third party risk management audits from a corporate perspective.

We regularly audited and questioned SMBs (and big corps) with regards to their security posture. We knew that small shops wouldn’t be able to be fully compliant to SOC2 Type 2 or have an ISO27001 certified environment. If it was clear that our business wanted the product, we either tried to help the company with the questionnaire or created a risk report that was then signed by the business. In other words: even if your customer asks you to be compliant, you don’t have to be if they care enough about your product.

If you seem intent on getting things right, that’s a big plus. Most of your competitors don’t even know what SOC 2 is.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#33

Post by Freak_NL »

sochix wrote: post #19
rozumbrada wrote: post #12

Not possible in case your clients are not stupid. Any company with SOC2 and You might find auditors that would go along but any reasonable client will check your SOC2 report and quality of your auditors. SOC2 requires tons of paperwork and management and separation of duties with also mandatory roles in your company - never feasible in a one man show.

So that means that solo-entrepreneurs can't sell apps to big enterprises due to SOC2 limitation? I think that it is not fair

You can. It just means that the customer has to do the proper analyses and risk evaluation for their own SOC2 (or ISO 27001 or whatever) certification.

Just focus on providing a good value application and be frank about what you do, why you can't get certification for something like that, but that you can answer any questions they might have for their own certification process.

If the potential customer makes 'has SOC2' a requirement, than that is not a customer for you, in the same way that 'has more than 20 employees' rules you out.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#34

Post by sochix »

_tk_ wrote: post #31

I was part of several third party risk management audits from a corporate perspective. We regularly audited and questioned SMBs (and big corps) with regards to their security posture. We knew that small shops wouldn’t be able to be fully compliant to SOC2 Type 2 or have an ISO27001 certified environment. If it was clear that our business wanted the product, we either tried to help the company with the questionnaire o…

Thank you for your comment!

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#35

Post by sochix »

flowerbreeze wrote: post #29

I've been through SOC 2 Type 2 in a company with ~100 people. I think it'd be in some ways simpler as a solopreneur, but still a lot of effort. You won't require as complex controls and you don't need to communicate between different parts of company, but it'll just be yourself doing it all. On a positive side, you won't have to do 100% of SOC 2 Type 2. The only required part is security if I remember correctly. And…

Thank you for your comment!

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#36

Post by crote »

I'm currently at a small startup trying to do ISO 27001. A big issue we run into is that there simply aren't enough people. For example, the processes are built around having one person who writes code, and another person who reviews the written code. That's obviously impossible as a solo dev. You also need an internal auditor, who obviously needs to be separate from the operations team.

If I recall correctly the minimum in a standard setup is 9 roles which cannot overlap. You're going to have a very hard time doing that as a solo entrepreneur, so you'll probably need to find someone who is experienced in making unusual setups like these compliant - which isn't going to be cheap. Even after that there's a pretty decent chance you'll end up needing to hire 3rd-party services in order to be compliant: our "internal" auditor is just some big firm doing it for us.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#37

Post by panflute »

rozumbrada wrote: post #12

Not possible in case your clients are not stupid. Any company with SOC2 and You might find auditors that would go along but any reasonable client will check your SOC2 report and quality of your auditors. SOC2 requires tons of paperwork and management and separation of duties with also mandatory roles in your company - never feasible in a one man show.

I've seen a small company do a SOC2 where the "CEO" seems to be the only actual employee..

Its a lot of paperwork but it is supposed to scale for company size so you could dismiss with a lot of the separation if the CEO accepts risks and perhaps relies on a fair amount of external systems that are already certified and has some contractors for specific tasks etc.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#38

Post by ownagefool »

crote wrote: post #36

I'm currently at a small startup trying to do ISO 27001. A big issue we run into is that there simply aren't enough people . For example, the processes are built around having one person who writes code, and another person who reviews the written code. That's obviously impossible as a solo dev. You also need an internal auditor, who obviously needs to be separate from the operations team. If I recall correctly the mi…

I offered self-hosting to bypass this. It did the trick and I was able to convert the enterprise customers where compliance was a red line.
Post reply on HN