Playbook: How to announce your security achievements

At Vanta, we firmly believe that your security program should be an integral part of your product, deeply ingrained in your value proposition. When treated as such, it can be a significant factor in helping you secure deals and outshine your competitors.

‍

When potential customers visit a website for a software product, they expect to see a comprehensive overview of that product, including its use cases, features, and recent updates. Since buyers increasingly consider security a critical aspect of their purchasing process, it makes sense to position security as the core product feature throughout the customer experience. Here's a blueprint for announcing updates to your security posture, whether it's SOC 2 compliance or any other security-related achievement.

‍

Tell your security success story

The software industry widely acknowledges that security is an operational practice. Preventing data breaches and attaining compliance certifications are integral to the operations InfoSec professionals manage. But how effectively are you conveying your security successes to your colleagues, customers, and prospects?

‍

Product teams employ well-established best practices to share their successful updates and releases, including product emails, release pages, and dedicated product marketing managers. We propose that security should have a comparable infrastructure dedicated to telling your security success story.

‍

‍Announce your compliance

Announcing your compliance is a significant milestone that allows you to showcase your hard work to customers, colleagues, and peers. One effective way to do this is by publishing an announcement through a blog post (here's a helpful blog template to get you started), followed by sharing updates on your company's social media platforms to amplify the news. Additionally, consider updating your marketing materials, website, and pitch decks to feature your SOC compliance badge. prominently.

‍

Document your compliance for customers & prospects

Establishing a Trust Center that outlines your security posture, including your newly achieved compliance, is the initial step in sharing your security narrative. Companies like incident.io, Lumos, Supabase, and Maze have all documented their compliance achievements in a Trust Center powered by Vanta. Others, like Slack and Monday.com, showcase their sccokplishments on a dedicated webpage.

‍

Regardless of where you host this information, productizing your security and outlining your newly achieved compliance gives website visitors a place to land when their mind starts wondering about your company’s security measures.

‍

Share your reports

While making compliance reports public is not advisable, it is crucial to make them accessible to interested customers and prospects. Most companies require a non-disclosure agreement (NDA) before sharing sensitive documents, and some opt to share these documents only at a specific stage in the sales cycle.

‍

At Vanta, we have choosen to host our SOC 2 Type II report within our Trust Center, where all visitors can see it is available and enabling them to request access. Access to the report is granted once the request has been approved and an NDA has been signed. This approach safeguards our reports from falling into the wrong hands while allowing customers and prospects to request them conveniently.

‍

Keep pursuing additional achievements

Celebrating your achievements is undoubtedly well-deserved, but compliance with a single security framework should not be your ultimate goal. Maintaining the controls you've established and fostering good compliance practices ensures you provide the best possible protection for your customers and simplifies the process when auditors return.

‍

Therefore, don't rest on your laurels. Keep pursuing additional achievements. Checking these compliance boxes is vital, but it's equally important to keep evolving your security program beyond these frameworks. Achieving SOC 2 compliance is a significant milestone, but it's not the end-all, be-all.

‍

By integrating security seamlessly into your product and consistently communicating your security achievements, you can not only enhance your company's reputation but also build trust with your customers and stay ahead in a competitive marketplace.

‍