3 ms·

Is there a guide to this for small teams and one man bands?

Aaronstotle 4y ago
I've worked at smaller orgs and my advice would be to first ask yourself if it's worth the cost, they are large time-sucks and cost intensive. If this is still something you want to pursue, hire experienced help. A majority of time spent in audits is figuring out what the auditors are looking for, and having someone experienced can save you a lot of headache. Be aware that compliance is more than a one time thing, and during this process you will have created either an entirely new department, or at the very least multiple work-streams.
deckard1 4y ago
The idea is for you to stop. Regulatory capture and learned helplessness. The costs of compliance require deep pockets. When you look at what they actually do, then it's obvious it's just theater. You'll see so many comments on HN that persuade you that security and privacy are too complex for you to handle (learned helplessness). It doesn't matter if your org is 2000 people with entire departments focused on compliance. Security and privacy will always be somewhere out there on the horizon. A mythical thing that no one can obtain. Definitely not a sole developer working alone in their bedroom. So better not try. Which is a bit crazy that this blog post is targeting "developers". As if developers care about any of this stuff. Executives at large corporations do. But those same developers working at that same company are off in agile land working on micromanaged tickets. They don't have a say in SOC. Not in whether it's worth it, not in how information is collected. Not even in how information is stored, in most cases. Because, again, SOC is top-down. Not bottom-up. The same executives pushing SOC are the same ones pushing Google Analytics. Theater.
trautlein 4y ago
I would repeat user Aaronstotle's comment that smaller teams are likely not the right audience for these levels of compliance. When it does become a concern, I think this post [0] put out by Latacora (no affiliation) is a great starting guide, although it is bent towards SOC 2 compliance. All of the items they mention are concrete wins for the business from a compliance/security perspective. The process of implementing just a few can help you better realize if your business is going to be able to muster the time and effort needed to continually work towards these standards, or if the business value isn't there yet. [0] https://latacora.micro.blog/2020/03/12/the-soc-starting.html https://latacora.micro.blog/2020/03/12/the-soc-starting.html
winrid 4y ago
Curious - would you even pass SOC2 as a one man band? Assuming you did everything else right, the report would still highlight the risk of one person bus factor.
- tptacek 4y ago
  They don't just make things up in the report; there's a set of controls and risks they capture. "Bus factor" isn't one of them.
  - Tostino 4y ago
    But things like "was there a review of this change?" are.
    - tptacek 4y ago
      Reviews don't have to be done synchronously or by different people. You could get a SOC2 report as a single-person operation; like any company that doesn't exactly follow the mold of the modal SAAS startup, you'll end up having more of a scoping conversation with your auditor than your peer companies would, but you don't get charged extra for that.
  - winrid 4y ago
    Neat! So only being one person isn't a risk? Interesting.
lmeyerov 4y ago
The recommendation for something like vanta or drata are spot on, and they have some somewhat cheaper competitors. So at cheap end say 5-10k for compliance management sw then 7-10k for auditor, and try to bargain a bit. Also maybe another 5-10k/yr on security related sw. FWIW doesn't make sense to me for most 1-person SaaS: if you had 30k+ sitting around just for compliance, and presumably 5-10x for other stuff, why not just hire a 2nd person? Small team can make sense if explicitly targeting a.niche regulated space tho. Otherwise wait till beyond a 2 pizza team. Note: I think it's an indictment of sw ecosystem that an earnest & diligent 1 person SaaS can't easily pass SOC2 style standards, or something equiv for the scale. SSO, RBAC, SIEM, IDS, default policies, etc -- like a SOC2-level heroku kit. Drata & Vanta are cool, but should shift further left.
reqres 4y ago
I've successfully implemented ISO 27001 (CTO, Sole Founder, ~USD2mn ARR SaaS Business). Had a small team around me (5 people) but essentially implemented ISO 27001 myself spread out over 6 months. Would be very difficult to write a complete guide - it's a long journey and accreditation requirements very specific to the business. Do you have specific questions or areas of concern in mind? Been thinking I could write a few blog posts about my experience.

I've worked at smaller orgs and my advice would be to first ask yourself if it's worth the cost, they are large time-sucks and cost intensive. If this is still something you want to pursue, hire experienced help. A majority of time spent in audits is figuring out what the auditors are looking for, and having someone experienced can save you a lot of headache. Be aware that compliance is more than a one time thing, and during this process you will have created either an entirely new department, or at the very least multiple work-streams.

deckard1 4y ago

The idea is for you to stop. Regulatory capture and learned helplessness. The costs of compliance require deep pockets. When you look at what they actually do, then it's obvious it's just theater. You'll see so many comments on HN that persuade you that security and privacy are too complex for you to handle (learned helplessness). It doesn't matter if your org is 2000 people with entire departments focused on compliance. Security and privacy will always be somewhere out there on the horizon. A mythical thing that no one can obtain. Definitely not a sole developer working alone in their bedroom. So better not try. Which is a bit crazy that this blog post is targeting "developers". As if developers care about any of this stuff. Executives at large corporations do. But those same developers working at that same company are off in agile land working on micromanaged tickets. They don't have a say in SOC. Not in whether it's worth it, not in how information is collected. Not even in how information is stored, in most cases. Because, again, SOC is top-down. Not bottom-up. The same executives pushing SOC are the same ones pushing Google Analytics. Theater.

trautlein 4y ago

I would repeat user Aaronstotle's comment that smaller teams are likely not the right audience for these levels of compliance. When it does become a concern, I think this post [0] put out by Latacora (no affiliation) is a great starting guide, although it is bent towards SOC 2 compliance. All of the items they mention are concrete wins for the business from a compliance/security perspective. The process of implementing just a few can help you better realize if your business is going to be able to muster the time and effort needed to continually work towards these standards, or if the business value isn't there yet. [0] https://latacora.micro.blog/2020/03/12/the-soc-starting.html https://latacora.micro.blog/2020/03/12/the-soc-starting.html

winrid 4y ago

Curious - would you even pass SOC2 as a one man band? Assuming you did everything else right, the report would still highlight the risk of one person bus factor.

tptacek 4y ago
They don't just make things up in the report; there's a set of controls and risks they capture. "Bus factor" isn't one of them.
- Tostino 4y ago
  But things like "was there a review of this change?" are.
  - tptacek 4y ago
    Reviews don't have to be done synchronously or by different people. You could get a SOC2 report as a single-person operation; like any company that doesn't exactly follow the mold of the modal SAAS startup, you'll end up having more of a scoping conversation with your auditor than your peer companies would, but you don't get charged extra for that.
- winrid 4y ago
  Neat! So only being one person isn't a risk? Interesting.

lmeyerov 4y ago

The recommendation for something like vanta or drata are spot on, and they have some somewhat cheaper competitors. So at cheap end say 5-10k for compliance management sw then 7-10k for auditor, and try to bargain a bit. Also maybe another 5-10k/yr on security related sw. FWIW doesn't make sense to me for most 1-person SaaS: if you had 30k+ sitting around just for compliance, and presumably 5-10x for other stuff, why not just hire a 2nd person? Small team can make sense if explicitly targeting a.niche regulated space tho. Otherwise wait till beyond a 2 pizza team. Note: I think it's an indictment of sw ecosystem that an earnest & diligent 1 person SaaS can't easily pass SOC2 style standards, or something equiv for the scale. SSO, RBAC, SIEM, IDS, default policies, etc -- like a SOC2-level heroku kit. Drata & Vanta are cool, but should shift further left.

reqres 4y ago

I've successfully implemented ISO 27001 (CTO, Sole Founder, ~USD2mn ARR SaaS Business). Had a small team around me (5 people) but essentially implemented ISO 27001 myself spread out over 6 months. Would be very difficult to write a complete guide - it's a long journey and accreditation requirements very specific to the business. Do you have specific questions or areas of concern in mind? Been thinking I could write a few blog posts about my experience.