4 ms·
> There are things you should start doing early that lay the groundwork for attestations, but you should be doing them anyways, even if you never plan to get a
by xyzzy_plugh 2y ago
> There are things you should start doing early that lay the groundwork for attestations, but you should be doing them anyways, even if you never plan to get a SOC2 (and if a big-ticket customer never demands it, you shouldn't SOC2). That's stuff like setting up single sign-on and having protected git branches; simple best practices.
This is in many ways the spirit of SOC2, no? There are a lot of startup founders, far more than I'd like, who would purposefully eschew such "simple best practices" unless they had an axe like a SOC2 audit swinging over them.
I think you're both right, for what it's worth, and my take is that you are more aligned with TFA than you perceive.
- tptacek 2y agoHow are we both right? I think you literally should wait until the last minute to start a SOC2 process.
- rendaw 2y agoGP's point is that having SSO and protected git branches _is_ starting the SOC2 process.
- koolba 2y agoThat and having a ticket system (e.g., Jira) to track why you touched prod and you can answer just about every question.
- tptacek 2y agoWe don't have that, and didn't need it for SOC2. (We have other ways of tracking prod changes, but our auditors don't know anything about them.)
- tptacek 2y agoI'm pretty sure that's not what the author meant. Again: those are things you should do regardless of whether you're ever going to get SOC2 (and a lot of startups shouldn't).
- deleted 2y ago[deleted]