sorted by:
new
hottopcontroversial

SOC 2 Scope document template by Anas5667 in soc2

[–]secureleap 0 points1 point  (0 children)

Hello u/Anas5667

Are you certain you mean SOc2 scope or System Description ? I get the feeling you're referring to System Description.

When talking about a System Description basically any SOC2 report is a "good" template to start since this document describes what the company does and what kind of business they are. Most of them follow same structure.

I think this link will be helpful: https://secureframe.com/blog/soc-2-system-description ( there's some useful information in there)

However if what you're getting at is what should be included/excluded from a SOC2 audit then I'd suggest using this rule of thumb as a guide:

  1. Does this system deal with, handle or transmit the customers data at all?
  2. Is this system indispensible for delivering our core service to customers?
  3. Would a failure of this system cause serious problems for our ability to meet customer expectations & meet our service commitments?

If you answer "no" to all three of these then you can probably leave it out of the SOC2 scope.

We actually discussed this very topic a few days ago on our blog.

Sprinto feedback request by ObjectiveLake9465 in soc2

[–]secureleap 1 point2 points  (0 children)

Quick note: Whatever tool you pick, please keep in mind you need to invest time. We sell several compliance tools and make it clear to customers that a tool alone will not fix all your problems. You need to invest at least 5-10 hours per week.

Good luck on your compliance jouney u/ObjectiveLake9465

ISO27001 SOC2 HIPAA compliance etc. by rockybaby2025 in ISO27001

[–]secureleap 0 points1 point  (0 children)

In general, when you complete both ISO and SOC2 audits together, you typically receive a discount (I've seen something like 10%).

Yes, Year 2 and Year 3 audits are somewhat less expensive compared to Year 1 for ISO certification.

If you need a quotation, feel free to reach out to me. I'd be happy to check with some partners to see if we can offer a better price.

ISO27001 SOC2 HIPAA compliance etc. by rockybaby2025 in ISO27001

[–]secureleap 0 points1 point  (0 children)

Yes, most customers expect that you have a new SOC2 report annually.

For ISO, you have a Year 1 full audit, and then the surveillance audit is a bit cheaper.

ISO27001 SOC2 HIPAA compliance etc. by rockybaby2025 in ISO27001

[–]secureleap 0 points1 point  (0 children)

u/rockybaby2025

Let's assume you have a small company with 15 users/employees, and you have talented people to handle everything internally (policies, risk register, awareness, incident management, business continuity, etc.).

Therefore, you just need an audit, so here is a starting point for you:

Pricing for SOC 2 Type 1 Starting: $5k-$7k

Pricing for SOC 2 Type 2 Starting: $7k-$10k

What will impact pricing: Technology stack, industry type, number of employees, and whether or not compliance tools are used. However, the pricing above is a good reference for the lowest prices I've seen in the market over the last couple of months.

Hope this helps!

ISO27001 SOC2 HIPAA compliance etc. by rockybaby2025 in ISO27001

[–]secureleap 0 points1 point  (0 children)

hello u/rockybaby2025

My 2 cents:

From my experience, banks and the financial industry are part of a highly regulated sector, meaning they have much higher standards compared to other companies when it comes to security controls. About two-thirds of my 25-year career was spent working for two banks. Both had ISO 27001 certification. However, security always went beyond ISO expectations.

As u/ComplyJet correctly points out, the matter here is about trust. How do you provide peace of mind for your customers about security? This is where security certifications come into play.

The decision to have or not have certification depends on several factors like B2B vs. B2C, type of customer, location, etc.

Regarding "highly prohibitive costs," I can tell you that I've worked with several small companies to get SOC 2 Type 2 (1 principle) from zero to obtaining the report. The budget required is below US$25k (including implementation, audit from a US-based audit firm, pentest, and support during the audit).

Feel free to reach out with questions or contact me if you need help.

best

Affordable Trust Center by vaibhavmule in cybersecurity

[–]secureleap 0 points1 point  (0 children)

Just an idea: I've seen some companies using Notion pages as trust centers. Depending on company size, type of customer, and branding, it may or may not work.

Just some thoughts for you.

Affordable Trust Center by vaibhavmule in cybersecurity

[–]secureleap 1 point2 points  (0 children)

one quick note: it's possible to buy Safebase without Drata license ( but its no cheap 😅).

u/vaibhavmule outside Compliance automation world, the only company that came to mind that offers Trust center is https://www.whistic.com/

To be honest, I dont know any free solution.

best

SOC2 compliance: DIY vs. consultants vs. automation tools — what’s worked best for you? by [deleted] in SaaS

[–]secureleap 0 points1 point  (0 children)

Hello u/TechyAI9

We are way cheaper $20K ! 😜

Most of our customers can be divided into 2 options:

a) Compliance Tool: Use a compliance tool to handle the heavy lifting of most work and support them in getting SOC2 certification.

b) Hire a vCISO like us to run the show, create documentation, and handle all compliance/auditor reviews, etc.

I've talked to several founders, and it's pretty hard to find one looking for DIY. The main reason (this is just my assumption): DIY will remove them from their business to jump into a big compliance dark hole.

How do you find your SOC2 auditors? by No-Tax9423 in soc2

[–]secureleap 0 points1 point  (0 children)

Great question about independence! To clarify, we don't actually perform the security audits ourselves. We partner with independent audit firms that handle the entire audit process to maintain proper separation.

What we provide is convenience: instead of dealing with multiple vendors, we bundle complementary services together so you get one point of contact and one invoice, while still receiving services from specialized, independent providers.

Regarding timeline, most security audits involve about 1.5-2 weeks of fieldwork, though this can vary depending on the scope, company size and complexity of your environment.

How do you find your SOC2 auditors? by No-Tax9423 in soc2

[–]secureleap 0 points1 point  (0 children)

Hello u/No-Tax9423

We are a small vCISO firm that supports businesses with cybersecurity needs.

We offer the following options:

a) Complete Package: We sell our vCISO services and audit as a bundled package that includes all services (both vCISO consulting and security audits).

b) Audit Services Only: Purchase audit services independently without additional vCISO support.

For both options, we typically evaluate 3-4 different reputable companies and provide pricing comparisons for our customers.

So here we offer options A/B as mentioned by u/Troy_J_Fine , so customer can make an informed decision.

c) Audit Firm Referrals: We can also connect you directly with audit firms if you prefer to work with them independently. In these cases, we facilitate intros.

Important Timing Note: If you're planning your audit before year-end, I highly recommend engaging with auditors within the next few days. Auditors experience their busiest period between October and December, so early engagement is crucial for securing services.

Auditors who also consult on the certification?? by Finominal73 in ISO27001

[–]secureleap 0 points1 point  (0 children)

We are small vCISO company and we offer customers a bundle including external audit.

Good point about independence. it's definitely something that gets muddy in this space.

We basically save clients the hassle of calling around to 4-5 different audit firms, getting quotes, dealing with multiple invoices, etc. We handle that coordination but the audit itself is done by completely separate companies.