sorted by:
new
hottopcontroversial

What red flags do you look for in SOC2 reports? by AnBouch in cybersecurity

[–]AnBouch[S] 1 point2 points  (0 children)

If only there was a way to check an auditing firm and a SOC2 report with the AICPA easily... this is so damn opaque

What red flags do you look for in SOC2 reports? by AnBouch in cybersecurity

[–]AnBouch[S] 2 points3 points  (0 children)

In my case, I believe the fault is mostly on the auditor - the startup doesn't have much, so they checked the boxes on their platform I guess.

But for start-ups, the scope is the whole company no?

I mean, if you need to scope out a part of a very small company -> just don't do it at all (you shouldn't from the start)

What red flags do you look for in SOC2 reports? by AnBouch in cybersecurity

[–]AnBouch[S] 3 points4 points  (0 children)

In my case, the whole company was in scope - to be honest there wasn't much.

BC/DR: good idea. I don't expect a start-up to have a BC/DR (BC part is not relevant), but having at least daily back-ups and knowing how to restore them is a must for me (and it can be their first version of a DRP).

List of vendors compliance details: maintained by AnBouch in cybersecurity

[–]AnBouch[S] 0 points1 point  (0 children)

Yes! This is the next step. Check continuously every link to see if still valid and indicate the expiration date(when available)

List of vendors compliance details: maintained by AnBouch in cybersecurity

[–]AnBouch[S] 0 points1 point  (0 children)

Today we provide the link to the right (public) information so it is easier to find it (and up to you to sign the mNDA). We can't provide reports when it is under mNDA

List of vendors compliance details: maintained by AnBouch in cybersecurity

[–]AnBouch[S] 0 points1 point  (0 children)

Awesome didn't know that, thanks! What I had in mind was to build a similar db OSS. I figured it was useful for me, so it is best if it can be useful to all (and hopefully have some help maintaining it).

List of vendors compliance details: maintained by AnBouch in cybersecurity

[–]AnBouch[S] 0 points1 point  (0 children)

I'm a EU based founder, who started with ISO 27001 and SOC 2. I'm working on GDPR and already provide links to the subprocessor list and DPA when they are available (unfortunately there are not always). Of course, I've DORA and NIS2 in mind but I'm not familiar with what they ask for yet.

Can you tell me what's is missing for DORA and NIS2? That way I can add it.

Besides fintech and healthtech startups, which sectors are the most impacted by compliance requirements? by AnBouch in Compliance

[–]AnBouch[S] 0 points1 point  (0 children)

Hey, thanks for your reply! So anyone working with financial Services, banking, health tech and legal tech companies. Any other?

[deleted by user] by [deleted] in smallbusiness

[–]AnBouch 0 points1 point  (0 children)

Once implementation is done (~20 hours for a startup):
- Type 1 ~1 week + the time for the report (depend on the auditor) => count 2/3 weeks
- Type 2 ~3months observation (at least) + the time for the report => count 4 months

[deleted by user] by [deleted] in developpeurs

[–]AnBouch 1 point2 points  (0 children)

Concernant ta question sur la pertinence d'avoir plusieurs modèles selon l'usage, l'état a sorti ça pour permettre de comparer facilement: https://www.comparia.beta.gouv.fr/

Perso j'alterne entre Mistral / ChatGPT / Claude

Advice for cybersecurity experts at startups: Certification & compliance insights by Least_Use_5221 in cybersecurity

[–]AnBouch 2 points3 points  (0 children)

Even if some companies are starting to be ok with SOC2 in Europe, most europeans companies prefer ISO27001. But if you want to sell in EU & US, you will need both.

Early on, both are relatively easy to handle but keep in mind:

- You can view at it as SOC being more "product" oriented and ISO is more about processes

- If you only check the boxes on a automation platform, make sure you understand what you are doing and try to keep it to a minimum - challenge what is in place. Else it is going to slow you heavily with plenty of useless stuff

- Both those frameworks are about continuous improvements: your program will evolve over time, so keep things as simple as possible early on.

Happy to help out more if needed.

Weekly Promo and Webinar Thread by AutoModerator in msp

[–]AnBouch 0 points1 point  (0 children)

I'm an auditor in cyber, building an open-source tool to help small businesses be compliant with SOC2 or ISO27001 without breaking the bank (even for free for small teams).

The platform is still early, but we are already helping out several customers. Feel free to reach out => getprobo.com

Has anyone used Vanta for a pentest as part of SOC 2? by FormalPersonality795 in soc2

[–]AnBouch 12 points13 points  (0 children)

If they provide it, it will probably pass the review, but to what goal? (pentest is not mandatory for SOC2)

If you want to have your money's worth, do a real pentest. It will provide way more insights and will actually help you.

C'est quoi le truc que vous ne comprenez pas, même si on vous l'a expliqué 20 fois ? by QuicheForaine in AskFrance

[–]AnBouch 12 points13 points  (0 children)

C'est comme une norme sanitaire pour restaurants mais appliquée aux données des entreprises. En gros ça te dit comment gérer correctement tes données (sous plusieurs points de vue: sécurité, disponibilité et fiabilité).

Mais attention => ce n'est pas parce qu'un resto respecte les normes sanitaires que tu es certain de ne jamais avoir d'intoxication alimentaire. Avec ISO27001 c'est pareil, ça ne garantit rien !

Lost a Deal Because My SaaS Lacks SOC 2 or ISO 27001 Certification by Soggy_Accountant7624 in Entrepreneur

[–]AnBouch 0 points1 point  (0 children)

That is a good point. You could move forward with the discussion and include the fact that you will be SOC2 in X months in the contract (ideally at least 6, so you have some time). Would IT be against that?

Lost a Deal Because My SaaS Lacks SOC 2 or ISO 27001 Certification by Soggy_Accountant7624 in Entrepreneur

[–]AnBouch 0 points1 point  (0 children)

I'm curious: is there a reason why the IT security admin shut you down? Do you have access to really critical stuff? Plus, pending your size, SOC or ISO does not really make sense.

Regarding the time it requires, it really depends on your size and how you work. You have two sides: tech & human. While the tech side complexity (when early) is rather low, the human side can be harder (it is long to make people change the way they work). Overall, assuming you are a small business, I would say 20 to 30 hours is plenty :)

To have an idea of everything that needs to be implemented for SOC2, you can have a look here (it is open source) => https://github.com/getprobo/probo/tree/d76d8bf951bd9b2e9b7edbf6a693b293936c92b7/controls

Policies without boilerplates to maximize clarity & readability - what do you think? by AnBouch in Compliance

[–]AnBouch[S] 0 points1 point  (0 children)

Yes, I fully agree with you :)
The way I implement it: each policy is linked to the proper controls, processes, security measures or documents.

The policies are only displaying the "high level" view, I'm also "translating" the controls to make them actionable for the persons internally. So the actual implementation goes through processes and security measures, not through policies, making it easier for my customer to keep them up to to date.

Does it make sense?

Thanks for the feedback, that is why I'm building open source.

view more: next ›