In a webinar with Insight Partners, Vanta CEO and co-founder Christina Cacioppo shared how your company can get started with SOC 2, and stop seeing sales get stuck in security review. 

Read on for a recap on SOC 2 basics, clarity about audit timelines and costs, tips from customers about when to get a SOC 2 — and how you can put your SOC 2 to work to scale your business.

‍

‍

If your company is working on selling into the enterprise, you may already have security on your radar. And if you’ve ever had a deal slow to a crawl or fizzle altogether once your company hit the security review, you’ll know that the importance of security and SOC 2 certification only continues to grow. Enterprise companies are increasingly focusing on the security postures of the startups with which they do business. Today, with more employees working remotely, enterprises recognize that they are confronting an expanded set of security challenges. SOC 2 offers a framework for mitigating security risks, and proving your company’s security in a clear and consistent way.

‍

What is SOC 2? 

‍

SOC 2 is a framework for the assessment and third-party verification of a company’s practices regarding the management of customer data.  

SOC 2 requires your company to establish or affirm its security controls — i.e. security rules or commitments — and how you’ll follow through on those controls. Your company determines what you want to promise you do to maintain security, and how you do it.

‍

Which report should I get: SOC 2 Type I or Type II?

‍

There are two types of SOC 2: Type I and Type II.

‍

‍

A Type I report is issued as of a specific date and represents an auditor’s review and approval of your systems at that moment in time.

A Type II report shows not only that you understand the necessary security procedures, but that you follow them over a period of time. This type of systems review results in an audit that yields a stronger and more trustworthy report.

There are three primary dimensions to consider in deciding which SOC 2 report your company will pursue: speed, strength, and cost. 

If you need a SOC 2 quickly — say an in-flight deal is blocked during the security review — a Type I report is the fastest type of SOC 2 report to secure. Your auditor will collect data for a day, and turn your report around in one to two months.

If you have some flexibility on time and are seeking a report that offers the greatest strength, a Type II report is the strongest form of SOC 2. You’ll collect data over a period of three to 12 months instead of a single point in time; you’ll talk with your auditor over that time period to review results in progress and ensure that you’re in good shape; and you’ll receive a SOC 2 report demonstrating the validity of your security controls as measured over time. 

If you start with a SOC 2 Type I, you may eventually need a Type II report as well. Enterprise customers are often seeking the strength of the SOC 2 Type II report. 

When deciding which SOC 2 path to take, evaluate the urgency of your need for a SOC 2. Consider the strength you need to demonstrate with your SOC 2 report, and consider whether you will eventually need to secure a SOC 2 Type II report. If time allows, focusing on a Type II report straightaway may be the most cost-effective for your company.

‍

Time + Money: How long will it take? How much will it cost?

‍

In the past, the SOC 2 audit process typically unfolded over a months-long period of first getting audit-ready — assessing security gaps, putting security controls and practices in place, and documenting those practices — then working with an auditor to review your company’s controls, and to manually prove that you’ve put security practices in place (imagine lots of screenshots). Audit readiness could take one to three months; working with your auditor to provide evidence, and for your auditor to prepare your report, could take an additional six to eight months. 

The cost of a SOC 2 can range from $10K to $80K or more. This is an estimate based on performing a readiness assessment (in-house or with a contractor); acquiring the tools your company will need to follow the rules you’ve established for your security program, such as background checks for employees; the prep work of writing security policies or updating existing policies and training employees; and finally, the audit itself, which can run $10K–$50K with costs that scale with company headcount. 

With a powerful automation tool like Vanta in place, your company can streamline its SOC 2 audit prep and evidence collection — and save time and money. Vanta gives your company a continuous monitoring tool, customizable controls, template policies, dashboards and more — ensuring your audit prep is much faster and more painless. Your auditor can leverage the continuously monitored data collected within Vanta to complete your SOC 2 report.

‍

When is the right time to get a SOC 2?

‍

The best time to get a SOC 2 is just before you need one. Even with automation, SOC 2 is a process, and you’ll want to leave your company time to go through that process. SOC 2 requires preparation and data collection as well as time to work with your auditor. In other words — there’s not a way to acquire a SOC 2 overnight. Start thinking about your SOC 2 proactively and your company will be ready with it when you need it. 

If you’re wondering whether the time is right for your company to get a SOC 2, consider its value. If you’re aiming to close a deal with a particular company whose business will be critical, your SOC 2 may pay for itself with a single deal. If you’ve been asked for your SOC 2 and have been leaning on workarounds, consider that putting your CTO on the phone with your prospects once a month may be feasible — but if your CTO is getting on the phone weekly or several times a week to talk security, then it might be time to get a SOC 2.

‍

Next steps: Put SOC 2 to work for your company

‍

‍

Proactively pursuing a SOC 2 gives you a powerful tool to communicate your company’s commitment to security. Demonstrating the strength of your security posture with your successful SOC 2 is a beacon for your prospects. 

Vanta equips your company with automated security and compliance, starting with SOC 2. Vanta supports companies on establishing security controls, conducting audit readiness prep, building security policies, setting up dashboards, and more. We’ll connect to your tools and infrastructure, customize Vanta to your company, help you fix items on your to-do list, and set you on the path to audit completion with an AICPA-certified auditor — all much faster and more painlessly than the typical audit process. Ready to get started?

‍