How we got SOC 2 certified in 3 months

If you're a SaaS startup, you have likely heard about SOC 2 compliance. If you've been putting it off, this article might convince you to get it started sooner than later. As we came to learn, SOC 2 comes with a series of great side effects that make you build your architecture and processs the right way from day one. I'll cover how Frigade went through this process as fast as it's legally possible without cutting corners or compromising on our product roadmap.

What is SOC 2 compliance exactly and why should I care?

SOC 2 compliance is a set of standards created by the American Institute of CPAs (AICPA) that aims to ensure that companies that handle sensitive customer data have appropriate controls and safeguards in place. SOC 2 covers five Trust Services Criteria (TSC): security, availability, processing integrity, confidentiality, and privacy. Companies undergo an audit by an independent third party to assess whether they meet the SOC 2 standards. Achieving SOC 2 compliance can help companies gain a competitive edge by demonstrating their commitment to protecting customer data, and can open the door to selling to larger companies that require SOC 2 compliance from their vendors. There are two types of SOC 2 certification: Type I, which evaluates your security systems at a single point in time, and the more stringent Type II, which checks for compliance continuously over six months.

Why get SOC 2 compliant sooner rather than later

Being SOC 2 compliant is essential when selling to larger companies. Enterprise companies take data protection seriously, and if you can demonstrate that you're SOC 2 compliant, you're more likely to win their business. Additionally, if you implement SOC 2 practices from day one, it will be less painful later on and reduce future throwaway work. This means you'll build your infrastructure in parallel with becoming compliant, allowing you to make better decisions early on and avoid cutting corners. For Frigade, this meant that we got to build our stack and process in parallel with our SOC 2 audit. It directly impacted our choice of service providers (avoiding future migrations), setting up proper monitoring, multi-colo failover, backups, device encryption, and much more. These decisions would otherwise very likely have been put off or been made arbitrarily.

How to become SOC 2 certified, fast.

The key to a fast and painless audit and certification is starting as early as possible. We started the process of becoming SOC 2 compliant shortly after incorporating Frigade despite still exploring different product ideas. You do not need to have PMF to get SOC 2 certified and unless you hard pivot into something radically different, your compliance should still stand.

Additionally, there are many other advantages to starting early on such as:

• Small staff. With 2 founders as the only employees, the process for everything from background checks, anti-virus, disk encryption, and more was infinitely easier to set up than for a company with 20 employees.
• Fresh stack. We built out our infrastructure based on SOC 2 requirements rather than migrating an existing stack.
• No process. If you're a small startup, you likely do not have any existing process that will need to be refactored. SOC 2 helps you set up proper on-call, monitoring, and HR. Measure twice, cut once.

Whether you're able to start early or not, the other thing that will help you significantly speed up the process is working with a modern Compliance as a Service company to complete the audit and certification. We worked with Vanta, which helped us speed up and automate the process immensely, and Drata is a popular choice among startups as well. Most modern compliance companies offer integrations with AWS, Github, Google Drive, and dozens of other integrations that help automatically run SOC 2 compliance tests against your system to ensure you remain compliant.

Conclusion

Becoming SOC 2 compliant is an essential step for any SaaS product that wants to protect its customer's data and grow its business. If you're an ambitious SaaS company, we highly recommend getting it done sooner to expedite your growth and make the process as simple as possible.