Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 164 posts

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#111

Post by apimade »

p_l wrote: post #50
apimade wrote: post #43

I’ll spend some more time replying to this next week, so circle back to this comment; I’m someone who regularly helps people get past these audits, meet the criteria customers are trying to assess with these certifications, and vet startups who don’t have these certifications or budget. Start by pre-filling your own CAIQ v4 with an earnest “we don’t do this” or “we haven’t even thought about this” attempt: https://cl…

Major problem of entire compliance/auditing industry is not enough asking in companies "what are the actual risks we are dealing with", "what's the goal for given control", "do we have alternative control ensuring that". Compounded by cheap shitty auditors that just mark down checkboxes on a worksheet

Agree, see the Delve fiasco. But that’s not their job. Their job is literally checkbox. However some audits are so poorly done, or have auditors with zero real world engineering or cyber experience, they’re actively harmful to a product or customer base.

Example: insane, complex password policies and password rotation policies. These are still pushed by auditors rather than trying to build a reasonable exception case with the client.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#112

Post by Nelkins »

tptacek wrote: post #57

Don't. You are exactly the wrong kind of firm to be pursuing SOC2. SOC2 is like the corporate GPL of security. It's an infectious secret handshake company security teams swap in lieu of filling out security questionnaires. Nobody savvy takes it seriously. There will come a time where your business will grow to the point where it makes sense to pay for the secret handshake. The overwhelming most likely scenario in whi…

Even though I agree SOC2 in practice is of dubious security value, I do think you can lose out on sales if you don't have it. I recently had to choose among a bevy of headless CRM options for a client, and they were adamant that whatever platform we used _had_ to be SOC2 compliant. This narrowed the field significantly and ultimately we went with Strapi solely because of this requirement. I see this come up all the time.

Tools like Vanta (and I'm sure others, Drata maybe, I haven't used them) make SOC2 compliance pretty "easy" in the sense that it's often a mechanical process that doesn't require too much thought. At least for me, it usually involves being in a Slack channel with an auditor, and they're advising you on all the things to do (they want you to "win"/pass, although there is no real pass fail), and then you just need to check the boxes in Vanta.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#113

Post by Nelkins »

jwr wrote: post #95

I am a solo entrepreneur. Don't. I learned that my business is unable to pass pretty much ANY certification or corporate IT security audit. Many of the questions simply do not apply to my business ("do you have documented procedures for revoking employee access") and the default answer is NO. Get even a single NO and you're done. I gave up and these days actively discourage enterprises from even trying to sign up — t…

> Get even a single NO and you're done.

Why do you think that's true? SOC2 isn't pass/fail, you receive a report on your business. You can have gaping security holes and be SOC2 "certified." It's just that your SOC2 audit will reflect that.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#114

Post by wahnfrieden »

tptacek wrote: post #57

Don't. You are exactly the wrong kind of firm to be pursuing SOC2. SOC2 is like the corporate GPL of security. It's an infectious secret handshake company security teams swap in lieu of filling out security questionnaires. Nobody savvy takes it seriously. There will come a time where your business will grow to the point where it makes sense to pay for the secret handshake. The overwhelming most likely scenario in whi…

Superwhisper got SOC2 around the same month they hired their first employee

I would guess they did it for due diligence compliance, not to enhance their security practices. It’s a b2b checkbox.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#115

Post by tortilla »

ErrantX wrote: post #107
tortilla wrote: post #102

Earlier quoted context omitted.

Same. For my business, the enterprises that want to use my software wouldn't actually be worth the hassle as their usage is not more than my normal business customers (SMB). Just more work and costs on my end. Early on, I had a potential enterprise account (well known online store) that wanted everything that enterprises wanted in addition to multiple meetings (with all the stakeholders) for a $50/month account (my m…

Your getting that interest because it looks like a steal. Ultimately those businesses couldn't care less about $50/m (except to chance it) but they want - or even need - the enterprise terms. They will pay $50 for your product... And probably $950 for the terms. (Not saying that would have been the right thing for you but my advice to folks who find themselves in this position is always 20x or 40x the price - if that…

My plans start at $50. Top out at $10k a month.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#116

Post by nrmitchi »

tptacek wrote: post #63
Keyframe wrote: post #13

I went through the process and while it seems it's daunting, it's just a bunch of work and some cash. Once established it's also transformative (or should be) on your ongoing processes and practices. You codify those into a bunch of documents (jesus, that's a lot of documents type of thing) and provide evidence for each; Auditors latch onto those randomly. It's then your job to upkeep documents and evidence which can…

I can't say enough how not transformative SOC2 should be on your processes. Near-automatic exception-free attestations should be a byproduct of basic sane corpsec practices. SOC2 should never be leading or informing your security practices. For people who don't know much about SOC2, the headline is that all SOC2 does is confirm that you do the things you say you do. There's a short vibes-based catalog of objectives -…

I completely agree with the outlook, but from a practical standpoint (in the last couple of years) I have seen the opposite. The SOC2 process is often transformative ("should" vs "is" are not the same thing).

Especially smaller startups, who grew somewhat quickly, and now "want to get SOC2 because customers want it". In practice this also (often, unfortunately) means "not all employees should have AWS admin creds, we should have some separation between environments, and we should know who has access to what".

For these companies SOC2 "requirements" can be the business-value line item that can get proper security and access-control patterns in place.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#117

Post by Marsymars »

apetresc wrote: post #103
gtech1 wrote: post #91

Earlier quoted context omitted.

Do you genuinely use em-dashes in your regular writing ? I'm just curious because whenever I type I simply press -

An em-dash is just Alt-(regular-dash) on most well-configured compose key configurations, it's not any harder.

This is also the default macOS/iPadOS configuration. (So I use em-dashes when I'm writing an macOS/iPadOS, but not on Windows.)

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#118

Post by tptacek »

Nelkins wrote: post #112
tptacek wrote: post #57

Don't. You are exactly the wrong kind of firm to be pursuing SOC2. SOC2 is like the corporate GPL of security. It's an infectious secret handshake company security teams swap in lieu of filling out security questionnaires. Nobody savvy takes it seriously. There will come a time where your business will grow to the point where it makes sense to pay for the secret handshake. The overwhelming most likely scenario in whi…

Even though I agree SOC2 in practice is of dubious security value, I do think you can lose out on sales if you don't have it. I recently had to choose among a bevy of headless CRM options for a client, and they were adamant that whatever platform we used _had_ to be SOC2 compliant. This narrowed the field significantly and ultimately we went with Strapi solely because of this requirement. I see this come up all the t…

I have an extended take on things like Drata and Vanta elsewhere in the thread. I think they're great if you know what you're doing, but dangerous if you don't: the expenses they incur are insidious, because they're not the sticker price of the software or the audit, but rather the unnecessary engineering they lead you to do.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#119

Post by tptacek »

Nelkins wrote: post #113
jwr wrote: post #95

I am a solo entrepreneur. Don't. I learned that my business is unable to pass pretty much ANY certification or corporate IT security audit. Many of the questions simply do not apply to my business ("do you have documented procedures for revoking employee access") and the default answer is NO. Get even a single NO and you're done. I gave up and these days actively discourage enterprises from even trying to sign up — t…

> Get even a single NO and you're done. Why do you think that's true? SOC2 isn't pass/fail, you receive a report on your business. You can have gaping security holes and be SOC2 "certified." It's just that your SOC2 audit will reflect that.

It won't even be that. You're not going to have any gaps in your Type I if your auditor is at all competent; your Type I documents what you were doing, aspirationally, at the time of your audit.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#120

Post by speleding »

codegeek wrote: post #85
tptacek wrote: post #57

Don't. You are exactly the wrong kind of firm to be pursuing SOC2. SOC2 is like the corporate GPL of security. It's an infectious secret handshake company security teams swap in lieu of filling out security questionnaires. Nobody savvy takes it seriously. There will come a time where your business will grow to the point where it makes sense to pay for the secret handshake. The overwhelming most likely scenario in whi…

I will add a few more things to this: - Document your data and security and share that with customers instead. You can say "We don't have SOC2 at the moment but here is all our security and data policy". It works 99% of the time for me. - Very few companies truly have policy to reject a vendor if they don't have SOC2. Those are usually large enterprise or companies in sensitive areas such as Finance/Healthcare etc. E…

I run a low 7 figures SaaS as well. This is the blurb I answer with when asked about SOC2 (yes, yes, AI generated):

"While we follow industry best practices that align closely with the requirements of SOC2 and similar frameworks, we have chosen not to pursue formal certification at this time. Maintaining multiple certifications and undergoing recurring audits across the various regions in which we operate would significantly increase our operational costs and, consequently, the price of our service."

Post reply on HN