The SOC2 Starting Seven (2020)

>At this point I think it would be pretty hard to do deals with public companies without having Type 2, and our domain isn't even that security focused.

Even if you avoid SOC2, the security questionnaires (mostly avoidable if you have SOC2) from large companies can be so onerous if you're doing any sensitive work for them that SOC2 would be cheaper and less effort than the time spent on the questionnaires and infrastructure changes to meet them.

Definitely paying too much @ $40K/$30K. Audit firms will cut their costs - don't take their first offer, it's a negotiation. Renegotiated down every year...they will want to reduce churn. Also, there are open source versions of Vanta and similar but those aren't really necessary - helpful - but not necessary. Same for pentests - I have had this conversation many times with SOC2 auditors to show me where it says you must have a pentest - many SOC2s later, never had to have one. That said customer contracts may require it, and some even specify the firms or onerous requirements for the chosen firms. We often argue Red Teaming exercises are better and win with that. I'll post a list of cost saving ideas up if anyone is interested. As for ROI - SOC2 is really only a sales enablement tool, nothing more. So it's really how many enterprise deals you will lose without SOC2 vs. how many you will win, and at what revenue. You can also negotiate transparently with your customer - most will say they want SOC2 but then if you add in extra cost to cover it, they back off. Until you have a 100K+ recurring (3 year ideally) deal ready to walk away, push back hard and be transparent with them on the added costs for paperwork. Offer to have a call with their security team and walk through your real security processes instead. Most customers are reasonable once you get past the outsourced procurement team. Helps to have a business sponsor who can cut through the red tape.

I've worked with multiple organizations through their entire SOC2 process and interviewed security teams from a bunch of other SOC2'd companies and the impression I'm left with is that you can get 100% of SOC2 just doing obvious best practices. Part of the reason I wrote this is to encourage engineering teams to push back on SOC2 processes that demand them to do new weird things.

I have kind of a meh opinion about Vanta, for what it's worth.

> The most important thing is committed spend

Yes, that's the thing--the grueling infosec process is independent of commitment. It's a catch-22.

It is a huge pain in the ass and I would not do it at your scale. Beyond the money, which is substantial --- even if you're smart about it, you're still going to sink tens of thousands into the stupid report --- it's going to eat months of your brain just to get the process going.

We have many clients asking for certification. We just say that we don’t have one, but our major vendors (eg aws) have a shit ton of them, and it seems to work fine.

Usually it’s not the certification that will make or break a deal, at least in our case.

They will first ask for the report/certifications, but if you don't have one, they'll likely proceed with asking more detailed questions about your security.

Putting the things mentioned in the article in place will help a lot in answering to those questionnaires.

We are also a really small company and get hit with these requests on a fairly regular basis. Our approach is to negotiate the actual security objectives and provide targeted assurances. Some customers are very strict with their requirements, but others are willing to negotiate.

We have signed on a publicly-traded entity without having a SOC2 on hand. It's not impossible to make a deal happen if the customer really wants your product, and you can somehow prove to interested parties that you wont sink their ship in the process. We achieved this with technical deep-dive sessions which involved our customer's IT and security people. Being able to communicate with agility and think outside the box is a good way to get around red tape.

For us, the biggest thing our customers seem to be worried about is the continuity of our business relative to support of the product. Offering source code escrow through some 3rd party is a good way to help alleviate some of these types of concerns.

That's strange - they won't send you a document from their auditors certifying that they've undergone some sort of SOC2-type audit? I don't really get why you'd withhold that, it's what you paid for.

We had a pandemic plan as part of our general DR/BC (disaster recovery / business continuity) plan for more than a decade. The joke was that we exercised it several times a year -- in winter, when the big snow storms hit and everyone worked from home.

In February 2020 I pointed out that we had not had a single mass work-from-home emergency, so shouldn't we hold the exercise? I convinced enough execs that we held a two-day test, on the basis that nearly anything can be postponed one day in order not to do it from home, but perhaps not two. We solved a bunch of issues... and then we left the office in mid-March and haven't been back en-masse since.

Literally the only reason to do SOC2 is if an important customer prospect that you are definitely going is demanding it; in fact, it might be better to say the only reason to do it is that you have to because you've got a contingent PO.

The policy docs are just filler. Auditors never look at them in any detail. They look for last revised date and last review date. Have bought $150 bundle online and submitted as-is without even replacing a single parameter and audit went fine.

but Vanta/Tugboat won't actually do the reviews and training and HR and executive reviews you need. Basically their deal is that they cut volume discounts with the audit firms and then take the rest. They have nice dashboards, don't get me wrong, but only their hand picked auditors will accept them. Others will require you to manually package up the same evidence anyway and upload to their IRL evidence system.

Be careful about SOC2 tooling that (1) asks you to do new stuff, or (2) that wants to become part of the fabric of how you manage hosts day-to-day.

Re (1): SOC2 is about adherence to a stated portfolio of controls. Different companies use different controls to reach the same control objectives. Almost all of the control objectives can be met with straightforward best-practices engineering, like having a carefully managed and logged SSO (a reason Okta is so popular), or --- I'm not exaggerating here even a little bit --- being able to describe the basic features of Github to an accountant. I've seen tooling that asks people to install all sorts of random security tooling on desktops and (worse) on servers; having been in SOC2 interviews with major-firm auditors, I can say with confidence none of them know what the fuck any of that shit means.

Re (2): SOC2 is not your security program. SOC2 has no good advice for your security program. Any competently run security program can, with enough grueling documentation, achieve SOC2. The very last thing in the universe you want is "SOC2" literally installing itself on your machines.

I think there's a lot of value in things that help you build and fill out checklists that will allow you to quickly and easily satisfy SOC2 IRL questionnaires; also just to keep yourself organized. But remember that the engineering should come from your engineering team, not from the absolute randos who build prefab SOC2 checklists.

I think this depends on your internal resources. TugBoat and Laika are more project management tools, a great question to ask is if you integrate with my Infrastructure, how many controls within the SOC2 framework are you actually automating. Vanta has been around awhile but I’ve heard mixed feedback from auditors as well as companies that use the tool. I’d recommend looking into Drata, they have the most automation and great auditor relationships. Happy to provide an intro to one of their audit partners that I used to work with to learn more from their perspective.

We did a Type 1 audit with Tugboat last year. I came away quite impressed - the default templates are a great starting point, and the evidence tasks are basically a giant todo list to assign and grind through. It turned a complex project with lots of unknowns into a much more straightforward project.

I know the term has a real legal meaning that doesn't apply here, but it's what everyone in the real world seems to say.

The audited firm is responsible for providing the "control" evidence, so if you say you rotated all your creds last year, and didn't use "solarwinds123", then the auditors will believe you. The auditors don't personally check the creds on all your systems, so while SOC2 gets your org thinking about all the right processes, the onus is still on your DevOps/SecOps/BizOps teams to do security right.

Overall, I'd rather being working with a certified vendor than not, but SOC2 ain't PCI.

Having been spammed by them out of the blue, a couple of times already this year, my feeling is that like most businesses, I already know what changes I'd have to make to improve.

Paying someone to give me a list of problems isn't at all useful until we have nothing else to do. Appreciate there may be others out there without the same understanding of Infosec, but frankly that's a greater risk to companies without those resources.

Totally worth it. SOC2 cost us $40k in year one and about $30k/year ongoing.

We found Vanta very helpful for identifying and managing all of the to-do's (gap analysis). Our initial discussion with an auditor was very paperwork-focused, and Vanta helped us see the gap analysis as technical/process focused (with the paperwork following, describing what we were now actually doing). It would have been much more challenging to achieve SOC-2 compliance without Vanta.

From a cost perspective, Vanta + a Vanta-partnered auditor was less expensive that just an auditor (presumably because the information was organized so the auditor had to do less work to complete the audit).

The Vanta platform ends up being a place to put documents so the auditor can find them (which is more useful than you might think if you haven't done a SOC-2 audit). They offer several Vanta-developed continuous monitoring tools (e.g., endpoint configuration monitoring, AWS vulnerability monitoring), which are not as well developed as independent tools (e.g., Kandji, AWS Inspector) but are convenient for auditors documenting continuous compliance.

As I understand it, they are working towards being more of an integration center for independent tools, so Kandji/AWS Inspector information can flow into the Vanta system.

A sales hurdle for selling to larger orgs.

A third party audit of your process (documentation, mostly) around managing risk.

SOC 2 stands for System and Organization Controls (SOC) 2 and is a comprehensive reporting framework put forth by the American Institute of Certified Public Accountants (AICPA) in which independent, third-party auditors (i.e., CPA’s) perform an assessment and subsequent testing of controls relating to the processes in scope

I clicked on the article thinking it was some kind of System On a Chip which is what I do for a living.

I scrolled through the article, realized it was not for me, but I still don't know if it is an acronym or what it really does.