5 ms·

Ask HN: Should my one person company get a ISO 27001?

• RollAHardSix 3y ago
  Unless you are having customers ask you for it, I would hold off. It's expensive, even done cheaply, most of the automation tools are just automated testing platforms with integrations to third-party systems that may or may not suit your environment. The templates are nice but as a 1 party shop you will end up rewriting large portions to suit your needs. I've done SOC2 and ISO implementation for a small business.
  • c27001 3y ago
    Thanks, I have had many customers ask for it but so far I have managed to talk my way out of it/ show them I take security seriously in other ways. Last week was first time I actually lost a big deal just because of lack of the certificate. Okay, you’ve tried tools like vanta?
    • RollAHardSix 3y ago
      Not Vanta, I researched it though. I examined SecureFrame and Drata, settled on Drata as it's more polished UI which matters to my management - expensive though, around 17k. Honestly you might be better off reviewing the COSO principles in the SOC2 standard itself and think how you can implement- it's freely available online. A tip, every time they say compliance in the document they mean compliance with your SLA's. Once you have a rough idea of your control structure you can write out policies - lighter is better - and source several online for free, after all of that you can engage an auditing firm who will give you a pre-assessment phase before moving into your SOC2 Type 1 or 2. Type 1 is a single day's control monitoring, Type 2 is over a period of time. Edit: Bah wrote all of this thinking SOC2. The ISO is behind a paywall, and heavier to implement in my professional opinion though there is a lot of overlap. I would seriously consider possibility of getting a SOC2 over ISO, for US customers it's almost all SOC2 as a requirement.
• iamflimflam1 3y ago
  In my experience, even when you have all these certificates, corporate IT will still want you to fill out there security questionnaire. I would do Cyber Essentials, and then once you’ve done the work for that Cuber Essentials plus should be straightforward. Most large businesses corporate IT departments realise that ISO certification is not something that small suppliers can do. I do know of companies that have stopped at Cyber Essentials plus and had no problems. One thing I have done previously is to create an IT security policy that is “aligned” with 27001. That can go a long way towards letting people know you take things seriously. The standard is pretty readable and all the things it says to do are completely reasonable and things that you should be doing anyway (or at least gave a policy around). My email is in my profile and I’m happy to share my boilerplate security policy with you.
• dyeje 3y ago
  You should not get SOC2, ISO27k, etc certified unless a customer demands it. Even then, as a 1 person company, you can probably push back and stress the simplicity of your operation to avoid it.
• e1g 3y ago
  I was in the same situation and had to get SOC 2 and ISO27001 to keep a juicy account. My suggestion would be "absolutely not until you absolutely must". It's a bottomless pit of time and money. All those "automation tools" (e.g., Drata/Vanta) help with 10-20% of the overall workload, and for me, took as many hours to set up as they saved. For ISO27001, your final annual cost will be $20-40k and will eat up 2-4 weeks per year. Implementing and maintaining a compliance program will do nothing to help you discover/solve customer problems or improve your security posture. Doing this work is the equivalent of "I want to do a startup, so I'm learning how to do business registration, taxation, comply with employment laws, and design business cards". Compliance will waste your already constrained resources, energy, and focus. It will slow you down and has such a negative ROI that you must have significant deals at risk to consider imposing this ongoing tax on your operations. In other words, wait until you're forced to by your customers/prospects.