This lessons learned series is part of our live SaaS resource list we're building while launching a new product.
This is specifically about the security requirements that companies need to meet in order to sell their product to other enterprises that legally or professionally require those standards.
What one lesson about security and sales was the most important and why?
If you're going to do enterprise sales, use software to build, manage and maintain all the key security information including your policies, background checks, system checks etc.
There are a number of companies that provide this software like Drata, Vanta, VGS and, while they vary a lot, they'll have all the checking and reporting functionality you need.
They provide the software as part of the SOC2 or ISO auditing process and we noticed that the security requirements of many enterprises pretty much fit the requirements within something like SOC2.
The cost? Approximately 2,000 per month.
In the early days this would be way too much and you could simply read up and create the docs yourselves and stick to those practices but at some point the $2,000 per month is worth it.
The SOC2 software costs around $1,000 per month and it's then another $12k per year for an auditor depending on the size of your company.
What dumb assumptions did we make about security at the very start of our SaaS journey?
At the start of our journey we didn't realise that those security forms large enterprises sent over to us all match up to common industry standards within ISO27001 and SOC2
For example, a company will ask us to fill out a security form that includes questions on our clear desk policy or whether we run internal security audits. Only after completing ISO and now SOC2 have we realised that the questions within those security docs matches up to security standards within ISO and SOC2.
At the start we casually filled it out and that may have cost us many deals. After ISO and with our new SOC2 reporting software it's a lot easier to complete.
What's the one thing we did that made a big difference?
Keep a bug bounty going. It's an absolute pain to deal with sometimes because so many people report the same nonsense bugs but in-between you get some gems. Some bug bounty hunters take a good look at your system and find faults you didn't imagine.
What did we waste the most time on which we regret?
I'm not 100% certain if we need both ISO and SOC2. We could simply have done SOC2 and it would cover most of the ISO requirements. However, the SOC2 software we use only came out this year (2021) and many others have only just launched. We could just do one of them and save ourselves time by covering any missing areas ourselves.
What would we advise someone to do if they were starting from scratch?
If you're going to do the enterprise sales thing and you have the money then just pay for the software like Drata or Vanta and do the SOC2 audit.
Alternatively, you can cover most of the process yourselves without an audit. You can get hold of a standard set of SOC2 policy documents (there's around 20 of them) and edit those to make them your own.
Follow the key practices they ask for like background checks, clean desk policies, backups, maintaining a risk register, running audits, running penetration tests etc.
It's a lot of work but that helps you pass those security tests without being certified. It helps to have that certificate but you can tick off most of the boxes without it.
If we had a magic wand how would we use it to improve our security / sales process?
We'd magically match up the SOC2 report fields to the security doc fields. Even though our software generates a report the big companies don't necessarily accept that report. They have their own spreadsheets they want us to fill out, so we wish we could magically transfer the SOC2 report onto the spreadsheet. This would save hours per security spreadsheet.
How will we use our experience for our new product?
We'll continue to run a bug bounty and not because of enterprises requesting it but simply as a security measure.
As we expand we'll use our Drata software to onboard, background check new employees, train them in cybersecurity, make sure they use the password manager, ant-virus software and more.
Overall we have a good foundation to build on.
Top resources
Should SaaS companies be ISO27001 certified?
Yes, initially getting certified is quite a process and each year there’s an audit but does it help companies see you as more secure? Will it get you more customers? If you’re working with health or financial organisations then it’ll help you pass their security requirements faster, so yes it does but… you can prove you’re secure in other ways by running your own checks and documenting them.
Should SaaS companies get ISO certified
Drata reporting
When you get started with a system like Drata the great thing is that it generates a set of policies for you, which you then customise for your company. It stores these policies, links into your systems, shows you what else you need to do to secure your systems and more.
We'll update this resource section in the future with a link to an example security spreadsheet and how Drata helps complete that.
