4 ms·

I have a small SaaS. I have a couple large customers (large in size, not in sales) and a bunch of smaller ones. A potential customer has asked for SOC reports a

by dplgk 6y ago

I have a small SaaS. I have a couple large customers (large in size, not in sales) and a bunch of smaller ones. A potential customer has asked for SOC reports and my gut instinct is to simply say no deal. The ROI is not even close to making sense. This looks like a huge PITA besides being expensive and requiring yearly investment.

tptacek 6y ago
It is a huge pain in the ass and I would not do it at your scale. Beyond the money, which is substantial --- even if you're smart about it, you're still going to sink tens of thousands into the stupid report --- it's going to eat months of your brain just to get the process going.
- edrobap 6y ago
  I have startup that helps finance team automate the tasks that involve high volume of data. Given the nature of data, most of our customers require information security certifications. We started our SOC 2 type 2 scope period for audit last month. There is certainly a lot of time investment and we have tried to minimise it with help of vanta.com Edit: we are a 3 year old startup
- smu 6y ago
  Yep! The article does a great job of cutting through all the noise. Highlighting here because it is relevant: certification is about sales. I’d only do it once you either: 1) you spend much more time filling out questionnaires than the time/investment needed to get certified (note, they’ll still ask you to fill out questionnaires though) 2) you want to go after companies that actually care about this (banking, government). Even then, these will have shortcuts through procurement that will lower requirements (ie: innovation projects, small ticket items)
  - bob1029 6y ago
    "Innovation projects" is how we got past the gatekeeper at our very first client (banking industry). We pitched it as an experimental technology that we wanted to partner with them to build out. No guarantees type of deal made it a lot easier to sell to the board, because we weren't proposing to put any line-of-business on top of it (at first). Once you have 1 client in your target industry using your product, it is infinitely easier to get a 2nd client (assuming you can use the 1st as a positive reference). SOC2 seems like an interview-time item if I were to try to put an analogy around it. Once you have a certain reputation and key players trust you, its a lot easier to navigate around regardless of your specific credentials.
  - tptacek 6y ago
    Fair warning: the article agrees with me because I wrote it. :)
redis_mlc 6y ago
I would not recommend doing the actual certification for most small companies, however doing the IT processes doesn't cost anything if you incorporate them over 1 - 2 years, and gives you a good story. If the prospect is just asking if you're compliant to exclude you as a vendor, then you need to find out right away and drop them as a prospect. Likely if they require SOC2, they also require other paperwork, payment terms, bank account clawback agreement, etc. that you don't want either. If you want to pay a nominal amount for a compliance strategy, leave a comment where I can find your email address.
orestis 6y ago
We have many clients asking for certification. We just say that we don’t have one, but our major vendors (eg aws) have a shit ton of them, and it seems to work fine. Usually it’s not the certification that will make or break a deal, at least in our case.
- twistedpair 6y ago
  From the buy side prospective, as someone that sits on a vendor review board, if there are two vendor options for a service, and one has SOC2 and the other doesn't, we'll lean heavily toward the SOC2 vendor. If you're the vendor, this can help your ASP. I've personally gone through certifying a company as SOC2 and it makes you realize how much you want your vendors to have SOC2 controls.
jpalomaki 6y ago
They will first ask for the report/certifications, but if you don't have one, they'll likely proceed with asking more detailed questions about your security. Putting the things mentioned in the article in place will help a lot in answering to those questionnaires.
- groundthrower 6y ago
  Same here, was initially asked to provide SOC2 report or ISO 27001 certificate, in addition to filling out cloud compliance matrix. Just tell them your aim is to get certified, and also show them that you take security very seriously- and it does not seem to be a requirement any more.
bob1029 6y ago
We are also a really small company and get hit with these requests on a fairly regular basis. Our approach is to negotiate the actual security objectives and provide targeted assurances. Some customers are very strict with their requirements, but others are willing to negotiate. We have signed on a publicly-traded entity without having a SOC2 on hand. It's not impossible to make a deal happen if the customer really wants your product, and you can somehow prove to interested parties that you wont sink their ship in the process. We achieved this with technical deep-dive sessions which involved our customer's IT and security people. Being able to communicate with agility and think outside the box is a good way to get around red tape. For us, the biggest thing our customers seem to be worried about is the continuity of our business relative to support of the product. Offering source code escrow through some 3rd party is a good way to help alleviate some of these types of concerns.

by dplgk 6y ago

tptacek 6y ago

It is a huge pain in the ass and I would not do it at your scale. Beyond the money, which is substantial --- even if you're smart about it, you're still going to sink tens of thousands into the stupid report --- it's going to eat months of your brain just to get the process going.

edrobap 6y ago
I have startup that helps finance team automate the tasks that involve high volume of data. Given the nature of data, most of our customers require information security certifications. We started our SOC 2 type 2 scope period for audit last month. There is certainly a lot of time investment and we have tried to minimise it with help of vanta.com Edit: we are a 3 year old startup
smu 6y ago
Yep! The article does a great job of cutting through all the noise. Highlighting here because it is relevant: certification is about sales. I’d only do it once you either: 1) you spend much more time filling out questionnaires than the time/investment needed to get certified (note, they’ll still ask you to fill out questionnaires though) 2) you want to go after companies that actually care about this (banking, government). Even then, these will have shortcuts through procurement that will lower requirements (ie: innovation projects, small ticket items)
- bob1029 6y ago
  "Innovation projects" is how we got past the gatekeeper at our very first client (banking industry). We pitched it as an experimental technology that we wanted to partner with them to build out. No guarantees type of deal made it a lot easier to sell to the board, because we weren't proposing to put any line-of-business on top of it (at first). Once you have 1 client in your target industry using your product, it is infinitely easier to get a 2nd client (assuming you can use the 1st as a positive reference). SOC2 seems like an interview-time item if I were to try to put an analogy around it. Once you have a certain reputation and key players trust you, its a lot easier to navigate around regardless of your specific credentials.
- tptacek 6y ago
  Fair warning: the article agrees with me because I wrote it. :)

redis_mlc 6y ago

I would not recommend doing the actual certification for most small companies, however doing the IT processes doesn't cost anything if you incorporate them over 1 - 2 years, and gives you a good story. If the prospect is just asking if you're compliant to exclude you as a vendor, then you need to find out right away and drop them as a prospect. Likely if they require SOC2, they also require other paperwork, payment terms, bank account clawback agreement, etc. that you don't want either. If you want to pay a nominal amount for a compliance strategy, leave a comment where I can find your email address.

orestis 6y ago

We have many clients asking for certification. We just say that we don’t have one, but our major vendors (eg aws) have a shit ton of them, and it seems to work fine. Usually it’s not the certification that will make or break a deal, at least in our case.

twistedpair 6y ago
From the buy side prospective, as someone that sits on a vendor review board, if there are two vendor options for a service, and one has SOC2 and the other doesn't, we'll lean heavily toward the SOC2 vendor. If you're the vendor, this can help your ASP. I've personally gone through certifying a company as SOC2 and it makes you realize how much you want your vendors to have SOC2 controls.

jpalomaki 6y ago

They will first ask for the report/certifications, but if you don't have one, they'll likely proceed with asking more detailed questions about your security. Putting the things mentioned in the article in place will help a lot in answering to those questionnaires.

groundthrower 6y ago
Same here, was initially asked to provide SOC2 report or ISO 27001 certificate, in addition to filling out cloud compliance matrix. Just tell them your aim is to get certified, and also show them that you take security very seriously- and it does not seem to be a requirement any more.

bob1029 6y ago

We are also a really small company and get hit with these requests on a fairly regular basis. Our approach is to negotiate the actual security objectives and provide targeted assurances. Some customers are very strict with their requirements, but others are willing to negotiate. We have signed on a publicly-traded entity without having a SOC2 on hand. It's not impossible to make a deal happen if the customer really wants your product, and you can somehow prove to interested parties that you wont sink their ship in the process. We achieved this with technical deep-dive sessions which involved our customer's IT and security people. Being able to communicate with agility and think outside the box is a good way to get around red tape. For us, the biggest thing our customers seem to be worried about is the continuity of our business relative to support of the product. Offering source code escrow through some 3rd party is a good way to help alleviate some of these types of concerns.