3 ms·
Right, I setup SOC2 compliance processes for a small startup, and we didn't have money to buy all those fancy automation programs. We managed ourselves with rec
by xtracto 5y ago
Right, I setup SOC2 compliance processes for a small startup, and we didn't have money to buy all those fancy automation programs. We managed ourselves with recurring JIRA tickets and screenshots taken by personnel.
I think the only service we had to pay was for security awareness training, and it was a site that provided security awareness videos..
- tptacek 5y agoThis is what a lot of companies do for SOC2. There's a cottage industry of consultants and product vendors selling companies on the idea that SOC2 is difficult and needs bespoke automation, but plenty of companies get by with just Jira. For that matter: you probably didn't need to spend money on security awareness videos.
- xtracto 5y agoYa, i bought knowbe4 because we also needed it for PCI compliance, and it made things easier for the IT/Sec team. But you are right. All those ceryification companies are a mafia.