> If you're a company doing B2B sales, how often do prospective customers ask about the certificate? We're an authorization API company, so we may not be repre

> If you're a company doing B2B sales, how often do prospective customers ask about the certificate? We're an authorization API company, so we may not be representative, but it definitely comes up, even in the context of early-stage SaaS startups that are selling into larger accounts. > When did you decide that it's time to get it done? It's certainly a pain, but somewhat ironically, the smaller / younger your company is, the easier it is to institute some of the processes than if you wait until you're larger. There are companies out there (hyperproof.io is one of them) that sell SaaS products that help you streamline the workflow for ISO, SOC2, et al.