5 ms·
A lot of startups move fast with a small team. You build something great and big corporation X wants to buy a subscription but you need to be certified. Much
by fareesh 7mo ago
A lot of startups move fast with a small team.
You build something great and big corporation X wants to buy a subscription but you need to be certified.
Much of this is a good checklist but some of it is very european.
"Where is the risk register to track controls in your 7 person company?"
Now instead of doing what your team does best, you are doing paperwork theater for frameworks designed for a 100,000 employee enterprise.
You are documenting things nobody will read, making up processes that don't exist and translating the operations of a lean company into bureaucratic language.
What's needed is a variant of these standards for small teams, which is proportionate and pragmatic.
- ljm 7mo agoMaybe you suouldn't be hacking due diligence if your team isn't ready for it
- ceejayoz 7mo agoIsn't ready for, or doesn't need? I had to have meetings with… myself, at times, for compliance reasons.
- phyzix5761 7mo agoWhat is the purpose of a business though? To make profits for its owners. If the profit lies in doing all this corporate theater then that's the business. A company that focuses only on providing a service and product but ignores how their customer needs to use said service and product is going to go out of business.
- eikenberry 7mo agoThat is "a" purpose of a business, but not the primary purpose. The primary purpose of business is to provide a service or product people want. You can want profits all day long but if you don't have something people want you don't have a business.
- throttlebody 7mo agoI would argue that profits are a result of what you do and not the purpose... Obviously intertwined but that's why its important to pick something you like
- bandrami 7mo agoIf the purpose of every business were making profits every business would be a hedge fund (at which point there could be no hedge funds, but that's a separate issue). Profits are a necessary component of a businesses's activities, but not its purpose.
- IgorPartola 7mo agoExactly this. But my question here is also: is there not a competitive advantage to a big enterprise that applies standards in a more intelligent way? You have a SaaS, I have a Fortune 500 company that could use your product but I cannot use it because my procurement process is as long and winding ad the Road to Hana. In the meantime my competitor has a smarter procurement process that takes into account the impact and risk involved in renting your software. Don’t they get a competitive advantage over me by having a better process and as a result getting better vendors?
- mushufasa 7mo agoUnfortunately in most cases the buyers have way more liability/risk using a small vendor than opportunity. Often this is coming from regulators in certain industries. In scenarios where the company REALLY REALLY wants to buy the SaaS, they often will invest in the company, one of the reasons for which being to ensure they have the resources to go through all the red tape.
- bartman 7mo agoI’ve found CIS Controls v8.1 to be good and sane, with actual benefits to security. Level 1 is a solid base, and Level 2 is good for picking from depending on where risks exist in your business. CIS Benchmarks are worth a look too: They’re best practices for securing typical cloud platforms, SaaS and OS.
- bradfox2 7mo agoThis is as designed to gatekeep these customers. Those in control of the checklists stand to benefit.
- jordigg 7mo agoSOC 2 is mostly about proving you do what your policies say, and there’s more flexibility than people think. For small teams it doesn’t have to be heavyweight. A risk register can be a simple doc with a few real risks and mitigations. That said, I agree there’s a lot of theater. For smaller companies and budgets, it often turns into rubber stamping. Auditors rely on the evidence you provide, so the report can look much cleaner than day to day reality. Still, it has value. It forces you to formalize basic practices, and if you want those customers, you’re signing up for that level of scrutiny.
- fareesh 7mo agoIt ends up being a LARP In reality the starting point itself is something absurd like "all vendors must be ISO certified no exceptions" Nobody wants to be the person who says an exception is ok in this case, so you get lumped with having to certify. Now your color palette generator startup is doing ISO certification. You are holding quarterly "information security governance meetings" and maintaining a risk register for... "blue vs slightly different blue". Many such cases.
- Bombthecat 7mo agoGoing through this with a medical startup... We have like 2 developer. But to get investment, put the app online etc. We need to fill out those paperwork... For things which just don't exist...
- sidewndr46 7mo agoIsn't the point of the paperwork to get you to make those things exist?
- troupo 7mo ago> We need to fill out those paperwork... For things which just don't exist... Things like what? HIPAA?
- 1970-01-01 7mo agoThe risk register is ISO 27001. The "I" in ISO doesn't stand for Internet, it stands for international. You shouldn't be doing business with international customers if you don't have a risk register, which is why they're requesting it.
- SkinTaco 7mo agoWhy is the line drawn at being international? What is it about customers in Ethiopia that necessitates this? What is it about American (non-international) customers that doesn't require a register?
- hsbauauvhabzb 7mo agoShouldn’t according to who? Who appointed ISO to say what should and shouldn’t be done?
- 1970-01-01 7mo agoThe majority of countries that do business today have backed it. You are welcome to ignore it and work against the 160 countries that are using it.
- hsbauauvhabzb 7mo agowho. Countries are not people.
- 1970-01-01 7mo agoYou can just Google this. https://www.iso.org/who-develops-standards.html https://www.iso.org/who-develops-standards.html
- hsbauauvhabzb 7mo ago[dead]
- 7mo ago
- kingjimmy 7mo ago"is very european." ... aa yes consumer protections. very european.
- fareesh 7mo agoThis assumes that there is only 1 way to protect consumers
- troupo 7mo agoTranslation: all your rules and regulations are crap, and we don't want to comply with any of them. When in reality most rules and regulations are not crap, and you should care about them. Especially when your startup advertises compliance with HIPAA (medical records), PCI-DSS (payments data) and a bunch of other data protection standards and regulations.
- ozim 7mo agoMost rules and regulations are not crap. But whole compliance industry is crap. One way they inflate expectations to extract money the other way they cut corners to rubber stamp BS to make it as cheap as possible for themselves.
- fareesh 7mo agoData protection is a tiny component of what certifications like ISO and SOC2 involve. The data protection stuff is welcome and often pre-existing, the other stuff is what annoys people.
- michaelt 7mo ago> Now instead of doing what your team does best, you are doing paperwork theater for frameworks designed for a 100,000 employee enterprise. Have you considered that the kind of companies that demand SOC2 compliance would be happy to pay extra for SOC2 compliance, if you offered it as an optional add-on costing $200k per year?
- bob778 7mo ago$200k is more for FedRAMP or PROTECTED+, but I think you’d be able to create a “compliance” addon for $20k quite successfully.