The conversation

jwrHNSource author
Business & incomeExperience excerpt · English

I learned that my business is unable to pass pretty much ANY certification or corporate IT security …

… I learned that my business is unable to pass pretty much ANY certification or corporate IT security audit. Many of the questions simply do not apply to my business ("do you have documented procedures for revoking employee access") and the default answer is NO. Get even a single NO and you're done. I gave up and these days actively discourage enterprises from even trying to sign up — these kinds of discussions can take a lot of your time and the expected value is negative, because sooner or later those kinds of questionnaires will be required (quite often the engineer talking to you doesn't even know this). SOC2 falls into that category: you are unlikely to pass, and even if you do, enterprise customers will pull out their own questionnaires out of, well, let's just call it their store backrooms, and you will fail those. Waste of time.

Original discussionAsk HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?138 source comments · at import
6

What was this responding to?

Parent context · original excerpt

SO
sochixHN

Is it possible? Do you know success cases w/o spending 20+k $ on auditors? My customers bombards me with question about certification of my app Perfect Wiki, I need help with finding the best way to show them that my app could be trusted.

Full original

Community replies 0

No community replies yet. Add your perspective.

Replies from the source 6

Direct replies available in this import. Original-language excerpts.

TO
tortillaHN

Same. For my business, the enterprises that want to use my software wouldn't actually be worth the hassle as their usage is not more than my normal business customers (SMB). Just more work and costs on my end. Early on, I had a potential enterprise account (well known online store) that wanted everything that enterprises wanted in addition to multiple meetings (with all the stakeholders) for a $50/month account (my mistake for not getting that information upfront). Another time, a large Canadian media company wanted me to agree to an uncapped liability provision. Respectfully turned them down. All in all, I lost some prestige business but if I took them on, it wouldn't move my profit levels much.

Full original
NE
NelkinsHN

> Get even a single NO and you're done. Why do you think that's true? SOC2 isn't pass/fail, you receive a report on your business. You can have gaping security holes and be SOC2 "certified." It's just that your SOC2 audit will reflect that.

Full original
ER
ergocoderHN

> do you have documented procedures for revoking employee access The answer should be "yes". And here you just drafted one. That's the point of going through SOC2. You make policies that you don't have and execute the policies for some amount of time to pass SOC2.

Full original
OZ
ozimHN

If you are solo entrepreneur second that - no enterprise will rely on application built by a single person. I don't know how people are approached but company I work for - we basically were laughed out of the room when we had 10 employees with our SaaS solution. Something like passing 20 employees and 5 years on the market and no one is laughing at us.

Full original
KO
koliberHN

You can have an offboarding doc even if you don’t have employees. It will apply in the future once/if you do. It will be silly and useless now, but you can check it off as a YES.

Full original
CO
codegeekHN

I know a solo founder who got SOC2 certified. He is literally the only person running the product/company and is SOC2 certified. I found that hilarious to be honest. But he is trying to play the "win enterprise deals" game but not sure how that helps when you are literally 1 person.

Full original
Continue on Hacker News

Respect different perspectives. Share concrete experiences.

Sign in to post, reply, repost, and quote.