See also all the various "cloud security assessment" certificates for organizations. They require you to burn a ton of money drafting policies, writing TPS rep

See also all the various "cloud security assessment" certificates for organizations. They require you to burn a ton of money drafting policies, writing TPS reports, and generally just pushing pencils. Ostensively to improve the security of your SaaS, but really mostly to work as a barrier to entry. The cost of a full-time compliance officer is minuscule for well-funded startups, but a massive challenge for a bootstrapped business of two people in a garage. Hence well-funded startups do their best to encourage regulation that asks for as many certifications, trials and tribulations as possible.