The conversation

tptacekHNSource author
Business & incomeExperience excerpt · English

I wrote a post 6 years ago for my clients who were ideating getting SOC2; it's about the (very …

… I wrote a post 6 years ago for my clients who were ideating getting SOC2; it's about the (very small and very simple) set of engineering things you need to do to be in a place where you'll get an automatic SOC2 Type I attestation. It has held up very well. You should understand everything in this post well enough to have opinionated takes on everything in a SOC2 DRL, and to be in a position to tell your auditors to GTFO if they ask you to do more. https://www.latacora.com/blog/2020/03/12/soc2-starting-seven...

Original discussionAsk HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?138 source comments · at import
2

What was this responding to?

Parent context · original excerpt

KE
KeyframeHN

I went through the process and while it seems it's daunting, it's just a bunch of work and some cash. Once established it's also transformative (or should be) on your ongoing processes and practices. You codify those into a bunch of documents (jesus, that's a lot of documents type of thing) and provide evidence for each; Auditors latch onto those randomly. It's then your job to upkeep documents and evidence which can be helped with tools that have frameworks for those. We use drata and it's really simple and helpful to use. I don't think you would be able to be compliant as a solo dude though, not easily. A bunch of protocols and practices revolve around governance, handovers, failovers, risk mitigation etc and if you're the only guy there's a hard path ahead. Are you reviewing and approving your own code that goes to production? If things go down and you're the first to call (let's say …

Full original

Community replies 0

No community replies yet. Add your perspective.

Replies from the source 2

Direct replies available in this import. Original-language excerpts.

KE
KeyframeHN

Near-automatic exception-free attestations should be a byproduct of basic sane corpsec practices. being key here. if you realize it's not all that sane when you start reviewing things, what happened in our case was it allowed us (there were other signals as well) to regroup on our practices and then it was painless.

Full original
NR
nrmitchiHN

I completely agree with the outlook, but from a practical standpoint (in the last couple of years) I have seen the opposite. The SOC2 process is often transformative ("should" vs "is" are not the same thing). Especially smaller startups, who grew somewhat quickly, and now "want to get SOC2 because customers want it". In practice this also (often, unfortunately) means "not all employees should have AWS admin creds, we should have some separation between environments, and we should know who has access to what". For these companies SOC2 "requirements" can be the business-value line item that can get proper security and access-control patterns in place.

Full original
Continue on Hacker News

Respect different perspectives. Share concrete experiences.

Sign in to post, reply, repost, and quote.