Tag
Startups
17 articles
Trust and sales
The security page buyers check first
What a public security page needs on its first screen, the sections that follow, how to write claims a reviewer believes, and the red flags they notice.
6 min read
Compliance frameworks
What drives the cost of a SOC 2 audit
The scope decisions, evidence habits, and internal effort that set what a SOC 2 audit costs, and which of them you can change before you sign anything.
6 min read
Compliance frameworks
ISO 27001 for startups: a realistic first certification
What a small team needs for a first ISO 27001 certificate: a defensible scope, a working ISMS, the records auditors check, and the order to build it.
6 min read
Compliance frameworks
How to choose a SOC 2 audit firm
The checks that matter when picking a SOC 2 auditor: licensing, peer review, independence, who does the fieldwork, and what a proposal should commit to.
6 min read
Compliance frameworks
What a SOC 2 readiness assessment should cover
The eight areas a SOC 2 readiness assessment should cover, the outputs you should expect from it, and how to tell a useful assessment from a checklist.
6 min read
Trust and sales
Security reviews for startups without a report yet
How a startup with no SOC 2 report can still pass a buyer's security review: what to offer instead, how to present the audit timeline, and what to avoid.
6 min read
Compliance frameworks
Choosing your SOC 2 Type II observation period
How to choose the length and dates of a SOC 2 Type II observation period: what each length allows, how control frequency limits it, and where to put the end.
6 min read
Compliance frameworks
FERPA vs COPPA for EdTech companies
FERPA regulates schools and COPPA regulates operators. How the two laws differ, when both apply to one product, and how school authorization fits between them.
6 min read
Compliance frameworks
HIPAA for SaaS companies selling to healthcare
How a SaaS company works out whether it is a HIPAA business associate, what that role obligates it to do, and what healthcare buyers expect to see first.
6 min read
Privacy
GDPR for US SaaS companies
When the GDPR reaches a US SaaS company, the controller and processor roles you hold, and the obligations to put in place first, in a practical order.
6 min read
Privacy
Do you need a data protection officer?
The three Article 37 tests for a mandatory DPO, what core activities and large scale mean, who can hold the role, and how to record a decision not to appoint.
7 min read
Security engineering
MDM vs a lightweight endpoint agent
MDM enforces device settings; a lightweight agent reports them. What auditors need from endpoints, when each approach fits, and how to combine the two.
6 min read
Audit readiness
Fixing gaps before the observation period starts
How to sort readiness gaps by type, decide which must close before a SOC 2 Type II period starts, prove each fix works, and pick a start date you can hold.
6 min read
Audit readiness
First-audit mistakes, and how to avoid them
The mistakes that make a first SOC 2 or ISO 27001 audit slower and messier: aspirational policies, unknown populations, ignored vendors and the draft report.
6 min read
Compliance frameworks
How to scope your first SOC 2 report
The seven scoping decisions for a first SOC 2: services, system boundaries, categories, report type, vendors, and customer duties, agreed before the audit.
6 min read
Compliance frameworks
Choosing the right PCI DSS self-assessment questionnaire
Which PCI DSS self-assessment questionnaire fits depends on how you take card payments, not your size. The SAQ types, their eligibility tests, and the traps.
6 min read
Audit readiness
Planning your first audit timeline
Plan a first SOC 2 or ISO 27001 audit backward from the date it is needed: the steps that cannot be compressed, what each waits on, and where plans slip.
6 min read