17 ms·

> When did you decide that it's time to get it done? There is a time management component to this. If you're still in a deal without a 27001 certification, the

by tetha 5y ago

> When did you decide that it's time to get it done? There is a time management component to this. If you're still in a deal without a 27001 certification, the security questions don't go away. Instead, you get sent a security question set to answer. These question sets can be huge - our record is about 300 - 400 questions. And once you've answered those, you're not done - then you go into discussions with their cybersecurity about your answers. Once you're in the loop with a number of large deals, this becomes a huge time sink. And no, you can't give this to an intern, or just search-and-answer most questions, because every company formulates their questions and requirements differently and it takes some knowledge to figure out what they mean and want. And at times the discussions afterwards are even worse. I've had InfoSec-guys tell me they're concerned because I cannot give them the specific details on the physical security of an AWS datacenter because these are not available. As much work as getting and maintaining an ISO27001 certification is, there is a point after which it'll save you time and nerves.

x0x0 5y ago
It's probably easier to start w/ a SOC2 TypeII though. Once you get that down, you're at least 50% done with the 27001.
- tptacek 5y ago
  Why a Type 2? The documentation you'll generate for the Type 1 covers just as much questionnaire terrain as the Type 2 does.
  - spurgelaurels 5y ago
    Type 1 is a point in time, and it expires. Type 2 maintains it.
  - x0x0 5y ago
    Because most CISOs / security reviews we go through ask for it.
    - tptacek 5y ago
      But that's not the reason you gave for getting the Type 2! My experience has been that companies regularly close deals by committing to get a Type 1, for what it's worth.
      - seehafer 5y ago
        This is a YMMV situation I think. In our case, when we only had our Type 1, we did deals _conditional_ on getting Type 2 within a year.
      - x0x0 5y ago
        Right, it's multiple benefits: the soc2 has a lot of overlap with 27001, a bunch of overlap with hitrust, it's a bit easier to do, and the CISOs we talk to want the Type 2. Internally, you can bump up your security practices, eg it forced us into a level of internal controls that was early for a startup. But beneficial, imo. I really can't think of many drawbacks if you work with customers that ask for these things. In our case, the customer profile is from lower midmarket to Fortune 50. You probably can close deals (depending customer, obviously) by committing to a Type 1. We did that at the beginning, but it exposes you to a lot more interactions with the security team. While you rarely see deals fail for security reasons, I've had it happen. So my experience is the less interaction you have with them, the better off you are. And a Type II plus the annual (or more than annual) pen tests make a lot of the questioning less intense. btw (happy to disclose personally, but I keep my identity private on hn), you can get the audit done for a lot less than $70k if you use a smaller firm, and that never was a problem with our customers.
        tptacek 5y ago
        I've seen deals contingent on named and/or Big 4 auditors, so I'm going to go ahead and disagree there too. With major buyers, I think there's pretty general awareness that there's a race-to-the-bottom market for cheap SOC2 assessments. Anyways: the point I'm making is: a Type 2 probably doesn't do anything more to prepare you for 27001 (which you should not get) than a Type 1 does. The subject matter of the assessments are the same (in fact, the Type 1 essentially sets the playbook for the Type 2, which is something you should be careful about). Pentest reports can definitely mitigate security objections. T What's funny is that none of these certifications meaningfully require them. All the more reason not to pay much attention to them until you have to. You should think of SOC2 and ISO 27001 as exotic sales expenses, not as something your startup needs to engineer against.
- wglb 5y ago
  I wouldn't agree with that. It seemed like it was more like 20% of 27001.
john-tells-all 5y ago
Absolutely this. Each potential client has a unique generally quite substantial list of security/tech questions in several spreadsheets. You answer each one as well as possible, and give details. This is definitely not an intern gig: at my fintech startup we had the CEO or Dir Eng or myself (DevOps) do it. Generally all of us took turns. They're pretty onerous. Having done the work for the ISO-27001 helped. For that cert we'd already had to think about and document a ton of security related things. Potential clients were happy to take our internal docs (written for ISO) as details to their questions. If they actually read our docs or if it was just a checkbox requirement, that's a good question :)
tptacek 5y ago
My experience doing this for several large companies at a time is that the questionnaires don't really go away with certification. There are probably some shops where audit reports will substitute for the Excel spreadsheet Q&A's, but there are plenty of others where the Q&A is a dealbreaker part of procurements no matter what. If you're in a line of business where your customers have questionnaires, just plan on having someone whose job is to fill these things out.
- mathie25 5y ago
  We have a SOC2 report type II, and security questionnaires/meetings are still there. Once we had a security questionnaire from a potential customer, took a glance at it, told the customer "hey you can find all of the answers in our SOC2 report and in our CAIQ (CSA)", they told us to still fill the questionnaire...
- curmudgeon22 5y ago
  Agreed with this, we still get questionnaires.
- mrclark411 5y ago
  We got a SOC2... and still get questionnaires. It's the worst. Companies are just outsourcing their security reviews to the vendor. Rather than rely on a 3rd party audited document companies want their custom questions answered. BUT - they aren't custom questions - it's the same questions for every vendor and they are very often poorly worded. Then when we turn them in - there's no follow up questions which to me implies that no one is reading them. Security theater...
  - wglb 5y ago
    I would argue it is "Compliance Theater."
orwin 5y ago
Caveat: even with ISO27001 you will still have those questions with huge actors, especially industrials (service businesses are way, way lighter) or private-public sectors with huge incentives (energy, construction and medical). However, having passed the certification process still save time.
danuker 5y ago
> specific details on the physical security of an AWS datacenter So, you want to certify yourself as secure, yet you store data on other people's computers, and you don't know how they are protected?
- travgary 5y ago
  AWS is ISO and SOC certified so they get audited on physical security. I can m trust that they dis it right because they passed their audit. I don't have time to go bother AWS about their security cameras and key card procedures.
  - wglb 5y ago
    And no auditor is going to ding you for noting that you have deferred the risk to them.
- jkingsman 5y ago
  Certification allows you to form a chain of trust via providers who have had auditors validate and verify their security. When my company gets SOC2 audited, we don't have to audit AWS because AWS is also SOC2 compliant, and their business critical vendors are likewise or have been independently validated, etc. all the way down the chain.
- avianlyric 5y ago
  AWS has ISO27001 certification and more. The whole point of these certifications is that it proves a competent auditor came in and checked all of these things, so your customers don’t have too. Part of ISO27001 is proving that you’re supply chain is also ISO27001 compliant. So picking companies that are already certified makes that easy, because then the certification naturally recurses down your supply chain.
- kasey_junk 5y ago
  Do you actually run a soc or iso certified data center? Because 99.9% of companies, even those who don’t use cloud services, use other people’s racks, cages, power, network etc for certified systems. I do t think I know a single serious security professional that would raise an eye at using cloud resources. Quite the opposite, there is a fairly straightforward & repeatable process for securing cloud resources. Unlike on prem.
arraypad 5y ago
There's a very recently announced (https://security.googleblog.com/2021/10/launching-collaborative-minimum.html https://security.googleblog.com/2021/10/launching-collaborat...) initiative by Google, Salesforce, Okta, Slack and others to create a minimal security standard - https://mvsp.dev/ https://mvsp.dev/ - which will hopefully reduce this overhead and encourage an improvement in security across the industry.
- Mesmoria 5y ago
  I note that section 1.6 is "Comply with all industry security standards relevant to your business such as PCI DSS, HITRUST, ISO27001, and SSAE 18". That looks larger than all the other requirements.
  - ghiculescu 5y ago
    Yes, unsurprisingly, this is set up to protect incumbents that have collected all these certifications.
  - wglb 5y ago
    I think the intent here is to note that there may be business requirements about these that affect the security of your business. For example, if anyone pays you through credit cards, PCI DSS is non-optional. Certain transactions of health information will require Hitrust. Without them, you won't be able to do business, and while they seem large (PCI DSS if you have another company handle the cards, is a very simple self-assessment.)
  - sk5t 5y ago
    IME the human time cost and direct expense associated with obtaining HITRUST, even if you've already done SOC2, is roughly in line with buying a Lamborghini.
- linker3000 5y ago
  The 'standard' one I've been asked to complete a few times is the CAIQ: https://cloudsecurityalliance.org/artifacts/consensus-assessments-initiative-questionnaire-v3-1/ https://cloudsecurityalliance.org/artifacts/consensus-assess...
wglb 5y ago
We had one that was over 500 questions. And this is certainly the truth: > And no, you can't give this to an intern, or just search-and-answer most questions, Ah, but the answer for major suppliers such as AWS and Azure, etc, is their own ISO 27001, SOC2, etc, certifications that you can defer that risk to.

by tetha 5y ago

x0x0 5y ago

It's probably easier to start w/ a SOC2 TypeII though. Once you get that down, you're at least 50% done with the 27001.

tptacek 5y ago
Why a Type 2? The documentation you'll generate for the Type 1 covers just as much questionnaire terrain as the Type 2 does.
- spurgelaurels 5y ago
  Type 1 is a point in time, and it expires. Type 2 maintains it.
- x0x0 5y ago
  Because most CISOs / security reviews we go through ask for it.
  - tptacek 5y ago
    But that's not the reason you gave for getting the Type 2! My experience has been that companies regularly close deals by committing to get a Type 1, for what it's worth.
    - seehafer 5y ago
      This is a YMMV situation I think. In our case, when we only had our Type 1, we did deals _conditional_ on getting Type 2 within a year.
    - x0x0 5y ago
      Right, it's multiple benefits: the soc2 has a lot of overlap with 27001, a bunch of overlap with hitrust, it's a bit easier to do, and the CISOs we talk to want the Type 2. Internally, you can bump up your security practices, eg it forced us into a level of internal controls that was early for a startup. But beneficial, imo. I really can't think of many drawbacks if you work with customers that ask for these things. In our case, the customer profile is from lower midmarket to Fortune 50. You probably can close deals (depending customer, obviously) by committing to a Type 1. We did that at the beginning, but it exposes you to a lot more interactions with the security team. While you rarely see deals fail for security reasons, I've had it happen. So my experience is the less interaction you have with them, the better off you are. And a Type II plus the annual (or more than annual) pen tests make a lot of the questioning less intense. btw (happy to disclose personally, but I keep my identity private on hn), you can get the audit done for a lot less than $70k if you use a smaller firm, and that never was a problem with our customers.
      - tptacek 5y ago
        I've seen deals contingent on named and/or Big 4 auditors, so I'm going to go ahead and disagree there too. With major buyers, I think there's pretty general awareness that there's a race-to-the-bottom market for cheap SOC2 assessments. Anyways: the point I'm making is: a Type 2 probably doesn't do anything more to prepare you for 27001 (which you should not get) than a Type 1 does. The subject matter of the assessments are the same (in fact, the Type 1 essentially sets the playbook for the Type 2, which is something you should be careful about). Pentest reports can definitely mitigate security objections. T What's funny is that none of these certifications meaningfully require them. All the more reason not to pay much attention to them until you have to. You should think of SOC2 and ISO 27001 as exotic sales expenses, not as something your startup needs to engineer against.
wglb 5y ago
I wouldn't agree with that. It seemed like it was more like 20% of 27001.

john-tells-all 5y ago

Absolutely this. Each potential client has a unique generally quite substantial list of security/tech questions in several spreadsheets. You answer each one as well as possible, and give details. This is definitely not an intern gig: at my fintech startup we had the CEO or Dir Eng or myself (DevOps) do it. Generally all of us took turns. They're pretty onerous. Having done the work for the ISO-27001 helped. For that cert we'd already had to think about and document a ton of security related things. Potential clients were happy to take our internal docs (written for ISO) as details to their questions. If they actually read our docs or if it was just a checkbox requirement, that's a good question :)

tptacek 5y ago

My experience doing this for several large companies at a time is that the questionnaires don't really go away with certification. There are probably some shops where audit reports will substitute for the Excel spreadsheet Q&A's, but there are plenty of others where the Q&A is a dealbreaker part of procurements no matter what. If you're in a line of business where your customers have questionnaires, just plan on having someone whose job is to fill these things out.

mathie25 5y ago
We have a SOC2 report type II, and security questionnaires/meetings are still there. Once we had a security questionnaire from a potential customer, took a glance at it, told the customer "hey you can find all of the answers in our SOC2 report and in our CAIQ (CSA)", they told us to still fill the questionnaire...
curmudgeon22 5y ago
Agreed with this, we still get questionnaires.
mrclark411 5y ago
We got a SOC2... and still get questionnaires. It's the worst. Companies are just outsourcing their security reviews to the vendor. Rather than rely on a 3rd party audited document companies want their custom questions answered. BUT - they aren't custom questions - it's the same questions for every vendor and they are very often poorly worded. Then when we turn them in - there's no follow up questions which to me implies that no one is reading them. Security theater...
- wglb 5y ago
  I would argue it is "Compliance Theater."

orwin 5y ago

Caveat: even with ISO27001 you will still have those questions with huge actors, especially industrials (service businesses are way, way lighter) or private-public sectors with huge incentives (energy, construction and medical). However, having passed the certification process still save time.

danuker 5y ago

> specific details on the physical security of an AWS datacenter So, you want to certify yourself as secure, yet you store data on other people's computers, and you don't know how they are protected?

travgary 5y ago
AWS is ISO and SOC certified so they get audited on physical security. I can m trust that they dis it right because they passed their audit. I don't have time to go bother AWS about their security cameras and key card procedures.
- wglb 5y ago
  And no auditor is going to ding you for noting that you have deferred the risk to them.
jkingsman 5y ago
Certification allows you to form a chain of trust via providers who have had auditors validate and verify their security. When my company gets SOC2 audited, we don't have to audit AWS because AWS is also SOC2 compliant, and their business critical vendors are likewise or have been independently validated, etc. all the way down the chain.
avianlyric 5y ago
AWS has ISO27001 certification and more. The whole point of these certifications is that it proves a competent auditor came in and checked all of these things, so your customers don’t have too. Part of ISO27001 is proving that you’re supply chain is also ISO27001 compliant. So picking companies that are already certified makes that easy, because then the certification naturally recurses down your supply chain.
kasey_junk 5y ago
Do you actually run a soc or iso certified data center? Because 99.9% of companies, even those who don’t use cloud services, use other people’s racks, cages, power, network etc for certified systems. I do t think I know a single serious security professional that would raise an eye at using cloud resources. Quite the opposite, there is a fairly straightforward & repeatable process for securing cloud resources. Unlike on prem.

arraypad 5y ago

There's a very recently announced (https://security.googleblog.com/2021/10/launching-collaborative-minimum.html https://security.googleblog.com/2021/10/launching-collaborat...) initiative by Google, Salesforce, Okta, Slack and others to create a minimal security standard - https://mvsp.dev/ https://mvsp.dev/ - which will hopefully reduce this overhead and encourage an improvement in security across the industry.

Mesmoria 5y ago
I note that section 1.6 is "Comply with all industry security standards relevant to your business such as PCI DSS, HITRUST, ISO27001, and SSAE 18". That looks larger than all the other requirements.
- ghiculescu 5y ago
  Yes, unsurprisingly, this is set up to protect incumbents that have collected all these certifications.
- wglb 5y ago
  I think the intent here is to note that there may be business requirements about these that affect the security of your business. For example, if anyone pays you through credit cards, PCI DSS is non-optional. Certain transactions of health information will require Hitrust. Without them, you won't be able to do business, and while they seem large (PCI DSS if you have another company handle the cards, is a very simple self-assessment.)
- sk5t 5y ago
  IME the human time cost and direct expense associated with obtaining HITRUST, even if you've already done SOC2, is roughly in line with buying a Lamborghini.
linker3000 5y ago
The 'standard' one I've been asked to complete a few times is the CAIQ: https://cloudsecurityalliance.org/artifacts/consensus-assessments-initiative-questionnaire-v3-1/ https://cloudsecurityalliance.org/artifacts/consensus-assess...

wglb 5y ago

We had one that was over 500 questions. And this is certainly the truth: > And no, you can't give this to an intern, or just search-and-answer most questions, Ah, but the answer for major suppliers such as AWS and Azure, etc, is their own ISO 27001, SOC2, etc, certifications that you can defer that risk to.