When it does become a concern, I think this post [0] put out by Latacora (no affiliation) is a great starting guide, although it is bent towards SOC 2 compliance. All of the items they mention are concrete wins for the business from a compliance/security perspective. The process of implementing just a few can help you better realize if your business is going to be able to muster the time and effort needed to continually work towards these standards, or if the business value isn't there yet.

[0] https://latacora.micro.blog/2020/03/12/the-soc-starting.html

If this is still something you want to pursue, hire experienced help. A majority of time spent in audits is figuring out what the auditors are looking for, and having someone experienced can save you a lot of headache.

Be aware that compliance is more than a one time thing, and during this process you will have created either an entirely new department, or at the very least multiple work-streams.

FWIW doesn't make sense to me for most 1-person SaaS: if you had 30k+ sitting around just for compliance, and presumably 5-10x for other stuff, why not just hire a 2nd person? Small team can make sense if explicitly targeting a.niche regulated space tho. Otherwise wait till beyond a 2 pizza team.

Note: I think it's an indictment of sw ecosystem that an earnest & diligent 1 person SaaS can't easily pass SOC2 style standards, or something equiv for the scale. SSO, RBAC, SIEM, IDS, default policies, etc -- like a SOC2-level heroku kit. Drata & Vanta are cool, but should shift further left.

Would be very difficult to write a complete guide - it's a long journey and accreditation requirements very specific to the business. Do you have specific questions or areas of concern in mind? Been thinking I could write a few blog posts about my experience.

Regulatory capture and learned helplessness. The costs of compliance require deep pockets. When you look at what they actually do, then it's obvious it's just theater. You'll see so many comments on HN that persuade you that security and privacy are too complex for you to handle (learned helplessness). It doesn't matter if your org is 2000 people with entire departments focused on compliance. Security and privacy will always be somewhere out there on the horizon. A mythical thing that no one can obtain. Definitely not a sole developer working alone in their bedroom. So better not try.

Which is a bit crazy that this blog post is targeting "developers". As if developers care about any of this stuff. Executives at large corporations do. But those same developers working at that same company are off in agile land working on micromanaged tickets. They don't have a say in SOC. Not in whether it's worth it, not in how information is collected. Not even in how information is stored, in most cases. Because, again, SOC is top-down. Not bottom-up. The same executives pushing SOC are the same ones pushing Google Analytics. Theater.