While it is absolutely possible to prepare for a SOC-II audit without outside help, I recommend that startups without a CISO engage outside help as a part of that strategy. A vCISO or consulting company can help bring clarity to the roadmap and accelerate execution.
https://twitter.com/GeekmomK/status/1437023508110925826
Especially since most organizations don't decide to pursue SOC-II until there is customer pressure for it and sales are jeopardized. Timing and success become critical.
I didn't have outside help my first time through it. I thought the project was going to kill me. It at took at least 6-8 months longer than it should have because I had to find my way through it, and the audit itself was more stressful and time consuming than it needed to be.
I wasn't a CISO back then, just a manager trying to help. It was during that fateful project that I was first named as the "security officer" in the documentation.
The rest, as they say, is history. I was destined to become the glass of whiskey that you see before you today.
The rest, as they say, is history. I was destined to become the glass of whiskey that you see before you today.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
