SOC 2 compliance for startups
In a webinar with Insight Partners, Vanta CEO and co-founder Christina Cacioppo shared how your company can get started with SOC 2, and stop seeing sales get stuck in security review.
Read on for a recap on SOC 2 basics, clarity about audit timelines and costs, tips from customers about when to get a SOC 2 — and how you can put your SOC 2 to work to scale your business.
If your company is working on selling into the enterprise, you may already have security on your radar. And if you’ve ever had a deal slow to a crawl or fizzle altogether once your company hit the security review, you’ll know that the importance of security and SOC 2 certification only continues to grow. Enterprise companies are increasingly focusing on the security postures of the startups with which they do business. Today, with more employees working remotely, enterprises recognize that they are confronting an expanded set of security challenges. SOC 2 offers a framework for mitigating security risks, and proving your company’s security in a clear and consistent way.
What is SOC 2?
SOC 2 is a framework for the assessment and third-party verification of a company’s practices regarding the management of customer data.
SOC 2 requires your company to establish or affirm its security controls — i.e. security rules or commitments — and how you’ll follow through on those controls. Your company determines what you want to promise you do to maintain security, and how you do it.
Which report should I get: SOC 2 Type I or Type II?
There are two types of SOC 2: Type I and Type II.
A Type I report is issued as of a specific date and represents an auditor’s review and approval of your systems at that moment in time.
A Type II report shows not only that you understand the necessary security procedures, but that you follow them over a period of time. This type of systems review results in an audit that yields a stronger and more trustworthy report.
There are three primary dimensions to consider in deciding which SOC 2 report your company will pursue: speed, strength, and cost.
If you need a SOC 2 quickly — say an in-flight deal is blocked during the security review — a Type I report is the fastest type of SOC 2 report to secure. Your auditor will collect data for a day, and turn your report around in one to two months.
If you have some flexibility on time and are seeking a report that offers the greatest strength, a Type II report is the strongest form of SOC 2. You’ll collect data over a period of three to 12 months instead of a single point in time; you’ll talk with your auditor over that time period to review results in progress and ensure that you’re in good shape; and you’ll receive a SOC 2 report demonstrating the validity of your security controls as measured over time.
If you start with a SOC 2 Type I, you may eventually need a Type II report as well. Enterprise customers are often seeking the strength of the SOC 2 Type II report.
When deciding which SOC 2 path to take, evaluate the urgency of your need for a SOC 2. Consider the strength you need to demonstrate with your SOC 2 report, and consider whether you will eventually need to secure a SOC 2 Type II report. If time allows, focusing on a Type II report straightaway may be the most cost-effective for your company.
Time + Money: How long will it take? How much will it cost?
In the past, the SOC 2 audit process typically unfolded over a months-long period of first getting audit-ready — assessing security gaps, putting security controls and practices in place, and documenting those practices — then working with an auditor to review your company’s controls, and to manually prove that you’ve put security practices in place (imagine lots of screenshots). Audit readiness could take one to three months; working with your auditor to provide evidence, and for your auditor to prepare your report, could take an additional six to eight months.
The cost of a SOC 2 can range from $10K to $80K or more. This is an estimate based on performing a readiness assessment (in-house or with a contractor); acquiring the tools your company will need to follow the rules you’ve established for your security program, such as background checks for employees; the prep work of writing security policies or updating existing policies and training employees; and finally, the audit itself, which can run $10K–$50K with costs that scale with company headcount.
With a powerful automation tool like Vanta in place, your company can streamline its SOC 2 audit prep and evidence collection — and save time and money. Vanta gives your company a continuous monitoring tool, customizable controls, template policies, dashboards and more — ensuring your audit prep is much faster and more painless. Your auditor can leverage the continuously monitored data collected within Vanta to complete your SOC 2 report.
When is the right time to get a SOC 2?
The best time to get a SOC 2 is just before you need one. Even with automation, SOC 2 is a process, and you’ll want to leave your company time to go through that process. SOC 2 requires preparation and data collection as well as time to work with your auditor. In other words — there’s not a way to acquire a SOC 2 overnight. Start thinking about your SOC 2 proactively and your company will be ready with it when you need it.
If you’re wondering whether the time is right for your company to get a SOC 2, consider its value. If you’re aiming to close a deal with a particular company whose business will be critical, your SOC 2 may pay for itself with a single deal. If you’ve been asked for your SOC 2 and have been leaning on workarounds, consider that putting your CTO on the phone with your prospects once a month may be feasible — but if your CTO is getting on the phone weekly or several times a week to talk security, then it might be time to get a SOC 2.
Next steps: Put SOC 2 to work for your company
Proactively pursuing a SOC 2 gives you a powerful tool to communicate your company’s commitment to security. Demonstrating the strength of your security posture with your successful SOC 2 is a beacon for your prospects.
Vanta equips your company with automated security and compliance, starting with SOC 2. Vanta supports companies on establishing security controls, conducting audit readiness prep, building security policies, setting up dashboards, and more. We’ll connect to your tools and infrastructure, customize Vanta to your company, help you fix items on your to-do list, and set you on the path to audit completion with an AICPA-certified auditor — all much faster and more painlessly than the typical audit process. Ready to get started?
FEATURED VANTA RESOURCE
The ultimate guide to scaling your compliance program
Learn how to scale, manage, and optimize alongside your business goals.
PCI Compliance Selection Guide
Determine Your PCI Compliance Level
If your organization processes, stores, or transmits cardholder data, you must comply with the Payment Card Industry Data Security Standard (PCI DSS), a global mandate created by major credit card companies. Compliance is mandatory for any business that accepts credit card payments.
When establishing strategies for implementing and maintaining PCI compliance, your organization needs to understand what constitutes a Merchant or Service Provider, and whether a Self Assessment Questionnaire (SAQ) or Report on Compliance (ROC) is most applicable to your business.
Answer a few short questions and we’ll help identify your compliance level.
Does your business offer services to customers who are interested in your level of PCI compliance?
Identify your PCI SAQ or ROC level
The PCI Security Standards Council has established the below criteria for Merchant and Service Provider validation. Use these descriptions to help determine the SAQ or ROC that best applies to your organization.
Good news! Vanta supports all of the following compliance levels:
A SAQ A is required for Merchants that do not require the physical presence of a credit card (like an eCommerce, mail, or telephone purchase). This means that the Merchant’s business has fully outsourced all cardholder data processing to PCI DSS compliant third party Service Providers, with no electronic storage, processing, or transmission of any cardholder data on the Merchant’s system or premises.
Get PCI DSS certified
A SAQ A-EP is similar to a SAQ A, but is a requirement for Merchants that don't receive cardholder data, but control how cardholder data is redirected to a PCI DSS validated third-party payment processor.
Learn more about eCommerce PCI
A SAQ D includes over 200 requirements and covers the entirety of PCI DSS compliance. If you are a Service Provider, a SAQ D is the only SAQ you’re eligible to complete.
Use our PCI checklist
A Report on Compliance (ROC) is an annual assessment that determines your organization’s ability to protect cardholder data. If you’re a Merchant that processes over six million transactions annually or a Service Provider that processes more than 300,000 transactions annually, your organization is responsible for both a ROC and an Attestation of Compliance (AOC).
Automate your ROC and AOC
Download this checklist for easy reference
Learn more about how Vanta can help. You can also find information on PCI compliance levels at the PCI Security Standards Council website or by contacting your payment processing partner.
The compliance news you need. Delivered securely to your inbox.