4 ms·

Unless you are having customers ask you for it, I would hold off. It's expensive, even done cheaply, most of the automation tools are just automated testing pla

Unless you are having customers ask you for it, I would hold off. It's expensive, even done cheaply, most of the automation tools are just automated testing platforms with integrations to third-party systems that may or may not suit your environment. The templates are nice but as a 1 party shop you will end up rewriting large portions to suit your needs. I've done SOC2 and ISO implementation for a small business.

c27001 3y ago
Thanks, I have had many customers ask for it but so far I have managed to talk my way out of it/ show them I take security seriously in other ways. Last week was first time I actually lost a big deal just because of lack of the certificate. Okay, you’ve tried tools like vanta?
- RollAHardSix 3y ago
  Not Vanta, I researched it though. I examined SecureFrame and Drata, settled on Drata as it's more polished UI which matters to my management - expensive though, around 17k. Honestly you might be better off reviewing the COSO principles in the SOC2 standard itself and think how you can implement- it's freely available online. A tip, every time they say compliance in the document they mean compliance with your SLA's. Once you have a rough idea of your control structure you can write out policies - lighter is better - and source several online for free, after all of that you can engage an auditing firm who will give you a pre-assessment phase before moving into your SOC2 Type 1 or 2. Type 1 is a single day's control monitoring, Type 2 is over a period of time. Edit: Bah wrote all of this thinking SOC2. The ISO is behind a paywall, and heavier to implement in my professional opinion though there is a lot of overlap. I would seriously consider possibility of getting a SOC2 over ISO, for US customers it's almost all SOC2 as a requirement.

4 ms·

Unless you are having customers ask you for it, I would hold off. It's expensive, even done cheaply, most of the automation tools are just automated testing pla

by RollAHardSix 3y ago

c27001 3y ago
Thanks, I have had many customers ask for it but so far I have managed to talk my way out of it/ show them I take security seriously in other ways. Last week was first time I actually lost a big deal just because of lack of the certificate. Okay, you’ve tried tools like vanta?
- RollAHardSix 3y ago
  Not Vanta, I researched it though. I examined SecureFrame and Drata, settled on Drata as it's more polished UI which matters to my management - expensive though, around 17k. Honestly you might be better off reviewing the COSO principles in the SOC2 standard itself and think how you can implement- it's freely available online. A tip, every time they say compliance in the document they mean compliance with your SLA's. Once you have a rough idea of your control structure you can write out policies - lighter is better - and source several online for free, after all of that you can engage an auditing firm who will give you a pre-assessment phase before moving into your SOC2 Type 1 or 2. Type 1 is a single day's control monitoring, Type 2 is over a period of time. Edit: Bah wrote all of this thinking SOC2. The ISO is behind a paywall, and heavier to implement in my professional opinion though there is a lot of overlap. I would seriously consider possibility of getting a SOC2 over ISO, for US customers it's almost all SOC2 as a requirement.