Episode 37 of The Security Podcast of Silicon Valley aired on February 25, 2024. Jon McLachlan and Sasha Sinkevich, the co-founders of YSecurity, hosted it on their own, with no guest (Podbean, Apple Podcasts, Spotify, Jon on LinkedIn, Sasha on LinkedIn). The episode is called “Founder’s Guide to Compliance: The Introduction SOC2, ISO, NIST, HITRUST, PCI-DSS, FIPS, and more.”
It opened a series for founders on compliance standards. Jon set the tone in the first minute:
“This is a no BS zone where we will dissect everything that founders need to know”
Jon McLachlan, at 0:09
This page follows the conversation in order: a section for each part of it, fourteen figures, fourteen clips from the tape, a short note on each standard the episode names, the full transcript, and five tools: a quiz, a scorecard for whether you’re ready when a buyer asks about compliance, a calculator for what waiting costs, a timeline of the standards, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote or retell those words.
A new series, and a no BS zone
Jon introduced the series and Sasha as his co-host. Between them, they have started companies, worked at big companies and helped with these standards. Both come from cybersecurity, and both have done the work themselves:
“We’re right there where the rubber hits the road.”
Jon McLachlan, at 0:36
The aim was to get to the essence of each standard, fast, and to say what sits behind it.
Jon’s story
Jon started his career as a security engineer at Apple, where he worked on security in iTunes. He called security a passion he can’t explain. There are different types of security people, he said, and he isn’t one who avoids risk:
“In order to do great things and to experience great joys in life, you have to take risks.”
Jon McLachlan, at 1:24
Since then he has led teams at startups and at other companies, little ones included, and at his own company. He described the podcast as an authentic give back to the community, and a way to engage with entrepreneurs and founders.
Sasha’s story
Sasha’s security career started about a decade before the episode, in Silicon Valley, and Sasha credits the knowledgeable people there for that start. It began on a security team that served heavily regulated companies, among them the global financial institutions you’d think of, and built products for them:
“And so I’m quite familiar with compliance and regulations firsthand.”
Sasha Sinkevich, at 2:46
Sasha has also built startups from zero, which taught a lot of different things from a different angle. Compliance sounds complicated, Sasha said. It’s dry, and it comes with legal caveats. The series would translate it into simple English, with one disclaimer:
“By the way, none of us are lawyers or attorneys.”
Sasha Sinkevich, at 3:42
What the hosts bring is experience reading compliance requirements as an engineer would:
“We have experience in dissecting and translating complex compliance requirements through the language of engineering”
Sasha Sinkevich, at 3:49
Open the door, or close the deal
Jon asked Sasha for the mission. Sasha put it in one line:
“The whole purpose is to demystify compliance”
Sasha Sinkevich, at 4:10
Jon spelled out what that means for a founder. Know how each standard will affect your business once customers and potential customers start asking about it:
“We want to make sure that you’re not blindsided by them.”
Jon McLachlan, at 4:16
He described two types of customers. For some, a standard is what gets you in the room, and a lot of work follows. For others, the standard is what closes the deal:
“Sometimes these standards are just going to open the door”
Jon McLachlan, at 4:28
Timing is the other choice. A startup can raise its security maturity early, or wait. Jon allowed for waiting, with a cost:
“Sometimes the right answer is to wait, but it’s not always, and there is going to be a price to pay.”
Jon McLachlan, at 4:50
The calculator below puts a number on that price for your own deals.
The question now comes first
Sasha said the timing changed over the decade before the episode. A company used to go after SOC or ISO only when a customer said a deal needed it. By 2024, the question came at the start:
“even before you start the initial conversation with a potential customer”
Sasha Sinkevich, at 5:29
One of the first questions a customer asks is whether you have SOC 2 or ISO. Which one depends on the business and the product. Customers want to know you meet the minimum security practices they follow themselves, and one of the best ways to show it is a third party that attests on your behalf.
That third party is an auditor. If the request is new to you, What Even Is a SOC 2? explains the report, and the SOC 2 readiness checklist covers where to start.
Who should listen
Jon asked for feedback, and said the episodes to come would cut to the heart of the matter: the what, the why and the how of each standard. Then he asked Sasha who the series was for. Sasha named anyone thinking about starting a startup, anyone who started one recently, and anyone building a company.
The series was for the moments when compliance lands on a founder’s desk. A customer asks for your SOC 2 Type 2 report. Or a questionnaire arrives, and Sasha’s example was long:
“a security questionnaire with 800 different questions.”
Sasha Sinkevich, at 7:30
Both are stressful when your main goal is to close sales. Compliance becomes part of the sales process, and Sasha wanted to make that process less stressful.
Our post What Is a DDQ? covers due diligence and security questionnaires, and SOC 2 Type 1 vs Type 2 covers the two kinds of report.
Top down or bottom up
Whether you sell top down or bottom up, Jon said, the result is the same:
“you’re going to get these questions.”
Jon McLachlan, at 8:03
He listed the usual three: SOC 2, ISO and NIST.
A chain of trust
Sasha said the questions don’t come from people who want to waste your time. They come from regulation, and from an effort to bring more security into the space. Sasha welcomed that:
“It’s a very good thing that there is a lot more laws around data privacy”
Sasha Sinkevich, at 8:31
Your potential customers have customers of their own, and commitments that come with them. Sasha described the result as a web, or a tree, where each player has to make sure the next one meets the same bar:
“the next link in the chain is compliant with the same level of security and privacy”
Sasha Sinkevich, at 8:56
A piece of their business in your hand
Jon agreed and made it concrete. A customer hands you its data, and you process it, save it, store it and back it up:
“They’re putting a piece of their business in your hand.”
Jon McLachlan, at 9:13
“That is why they care.”
Jon McLachlan, at 9:17
Customers have to hold founders to the same bar they hold themselves. For a Fortune 500 or a Fortune 100 company, Jon said, that’s a high one.
Standards as a signal
Jon’s next point was what standards do for the founder:
“These standards help us get there.”
Jon McLachlan, at 9:31
They signal to the market that a company is mature enough to handle that responsibility and to succeed at it.
Standards that scale your decisions
Standards also help a company grow. Jon described the problem every founder hits:
“It is impossible to be part of every single decision that is made in your organization.”
Jon McLachlan, at 9:51
So how do you know the decisions made under the hood line up with where you’re taking the company, and with the customers you’re trying to close? His answer:
“you can use standards to help do that.”
Jon McLachlan, at 10:11
A standard gives the company a high, rigorous bar.
Every vertical has its own
Different verticals have their own standards. Jon named healthcare and FinTech. Some standards cut across markets, and some are specific to one, and the series planned to cover both. Jon said he has been through it himself, in different markets, at different startups and at different stages. He sees reaching this point as good news:
“It’s a sign of success to be able to be in a position where you’re starting to engage these things”
Jon McLachlan, at 10:49
The standards section below says where each one comes from. For healthcare, our HITRUST Certification team does the work, and The Health System Security Review Your BAA Won’t Pass covers what a hospital’s review asks.
A signal you take your startup seriously
Sasha asked Jon whether compliance is an essential part of doing business in 2024. Jon’s answer:
“It’s a clear signal that you are taking your startup seriously.”
Jon McLachlan, at 11:02
It shows you’re growing, growing aggressively, and that you know how to handle cybersecurity and risk as you grow. Then he asked about Sasha’s experience.
Compliance drives engineering controls
Sasha’s answer:
“There is nothing eye-opening about compliance.”
Sasha Sinkevich, at 11:24
What did become clear is that in certain verticals, meeting the minimum standards your customers present is essential to doing business there. Sasha’s view of what compliance is for:
“Compliance tends to drive engineering controls. These controls should not be done as a check mark.”
Sasha Sinkevich, at 11:43
The documents can be dry, and they still hold lessons:
“The standards are geared towards making sure that the basics are implemented properly.”
Sasha Sinkevich, at 11:56
So a lot of good can come out of the standards and frameworks the series planned to discuss.
Sales goals, growth goals, investment goals
Jon returned to the no BS promise. The series would take each standard and its details, take them apart, and show how to position them in a company: next to the sales goals, the growth goals, and maybe the investment goals.
Investors, breaches and private lives
Sasha picked up the word investors. What standards mean for investors deserves its own episode, Sasha said, and protecting investors’ money matters whether you launch your own company or work for a larger one:
“there’s always an investor in any venture.”
Sasha Sinkevich, at 12:47
Every one of those controls aims to protect the company and its customers.
“A simple breach could result in huge losses for a company.”
Sasha Sinkevich, at 12:58
A breach can also disrupt people’s lives. Sasha’s line on privacy:
“every private life deserves to be private”
Sasha Sinkevich, at 13:12
Private data goes public only when the person who owns it chooses that. It’s their decision. Sasha named who should never make it: an adversary, an attacker, or an honest mistake. Compliance, in this view, connects back to the real lives of people and of companies.
Privacy people depend on
Jon loves connecting this back to real lives. He said that especially in the United States:
“a lot of the privacy stuff is lost on us.”
Jon McLachlan, at 13:47
Many people use computer systems and depend on the privacy those systems claim to provide. His advice to listeners: grab a coffee and sit down, whether your startup is in a garage or you’re planning the next raise. The series was there to help with the complex space of compliance.
What is it, when do I need it, how long does it take
Sasha described how compliance feels to founders who are new to data security, data privacy and regulation: heavy, delicate and, for many, expensive. The series would simplify it to three questions:
“what is this? When do I need it?”
Sasha Sinkevich, at 15:02
“And how much time does it take me to implement the standards?”
Sasha Sinkevich, at 15:05
Our post How Long Does a SOC 2 Audit Take? answers the third question for SOC 2, with timelines, phases and a five-month case study.
The standards on the list
Jon asked which standards the series would go over. Sasha listed ISO, SOC, HITRUST, FIPS and NIST, starting with the basics, and more if listeners showed interest. The episode title adds PCI DSS. Jon asked listeners to say which topics they wanted covered. The standards section below has a short note on each.
Simple wins
Sasha asked where people could find Jon. Anywhere you listen to podcasts, he said, and he thanked the new listeners for joining a guided tour of compliance for founders. He promised to keep it simple:
“I’m a simple guy.”
Jon McLachlan, at 16:08
Sasha took that further:
“Complexity kills innovation.”
Sasha Sinkevich, at 16:12
“It’s pretty clear that robust solutions are always simple.”
Sasha Sinkevich, at 16:14
That’s the approach the series takes to compliance: boil each standard down to the core principles of what it means to follow it. Listeners can reach both hosts on LinkedIn.
Next up: SOC 2
Jon hoped listeners would get enough out of the episode to share it with entrepreneur friends who struggle with the same pains around compliance. Sasha thanked them for listening. Jon closed with the plan: the next episode would be SOC 2, followed by a joke about socks.
The feed never carried a second episode under the series name. What happened after the tape says where the SOC 2 conversation went.
The standards, one by one
The episode title names SOC 2, ISO, NIST, HITRUST, PCI DSS and FIPS. A short note on each, from public sources, plus GDPR, the European Union’s privacy regulation:
SOC 2 is an audit report. System and Organization Controls reports are a suite of audit reports defined by the American Institute of Certified Public Accountants, so service organizations can issue validated reports on their controls. The reports group controls into five categories called the Trust Services Criteria, which the institute set in 2017 (Wikipedia). What Even Is a SOC 2? is our plain-English guide, and our SOC 2 Type 2 team gets you the report.
ISO/IEC 27001 is a management system. ISO and the IEC first published it in October 2005, with revised editions in 2013 and 2022. It sets the requirements for an information security management system (Wikipedia).
The NIST Cybersecurity Framework is guidance. NIST developed it in 2014 to help organizations assess and improve how prepared they are for cybersecurity threats. Version 1.1 came in 2018. Version 2.0 added a sixth core function, Govern, next to Identify, Protect, Detect, Respond and Recover (Wikipedia).
HITRUST started in healthcare. It was formed in 2007, in response to healthcare data breaches, growing federal and state compliance mandates, and the need for a standard approach to protecting information in healthcare. It provides risk management and compliance assessments and certifications, and it first focused on HIPAA (Wikipedia). Our HITRUST Certification team runs the assessment with you.
PCI DSS covers card data. It governs how companies store, process and transmit cardholder data. Version 1.0 came out in December 2004, and in September 2006, MasterCard, American Express, Visa, JCB International and Discover set up the PCI Security Standards Council to govern it (Wikipedia).
FIPS 140-3 approves cryptographic modules. It’s a U.S. government standard, Security Requirements for Cryptographic Modules, first published on March 22, 2019. It replaces FIPS 140-2 (Wikipedia). Federal buyers come with their own program for cloud products, which our FedRAMP Readiness team prepares you for.
GDPR is a regulation. Regulation (EU) 2016/679 covers information privacy in the European Union and the European Economic Area. It was adopted on April 14, 2016 and took effect on May 25, 2018. Fines can reach 20 million euros or 4% of worldwide annual turnover, whichever is greater (Wikipedia).
Amazon Web Services publishes its own list. It names SOC, ISO 27001, PCI DSS, FedRAMP and HITRUST among its certifications and attestations, and NIST frameworks among its alignments (AWS).
What happened after the tape
CSF 2.0 came out the next day. NIST published version 2.0 of its Cybersecurity Framework on February 26, 2024, one day after the episode. It describes outcomes that any organization can use, regardless of its size, sector or maturity, and it added Govern as a sixth core function (NIST, Wikipedia).
ISO/IEC 27001 got an amendment. In February 2024, the 2022 edition gained an amendment on climate action changes (Wikipedia).
FIPS 140-2 reached its end date. All FIPS 140-2 validations were set to move to the Historical List on September 21, 2026, whatever their final validation date. FIPS 140-3 supersedes it (Wikipedia).
The series stayed at one episode. The feed has no later episode called The Founder’s Guide to Compliance. The SOC 2 conversation went on with guests. On episode 52, Suha Can, then CISO of Grammarly, covered SOC 2 and ISO 42001 with Jon and Sasha. On episode 64, Daniel Marashlian, co-founder and CTO of Drata, told them about a SOC 2 request that pulled engineers off the roadmap. About a year before this episode, on episode 27, Colin Bitterfield of People Data Labs had described getting SOC 2 in six months.
The SOC 2 guides are on our blog. They cover the SOC 2 basics the next episode was meant to cover: What Even Is a SOC 2?, SOC 2 Type 1 vs Type 2, How Long Does a SOC 2 Audit Take? and SOC 2 in Progress?, for when a buyer asks before the report is done.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript or its section.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it.
-
What did Jon call the new series in its first minute?
a. "This is a no BS zone where we will dissect everything that founders need to know" Transcript, 0:09.
-
By 2024, when did Sasha say customers ask about SOC 2 or ISO?
c. It used to come only when a deal needed it. See The question now comes first.
-
How many questions were in Sasha's example security questionnaire?
b. "a security questionnaire with 800 different questions." Transcript, 7:30.
-
Why do customers care, in Jon's words?
a. "They're putting a piece of their business in your hand." Transcript, 9:13.
-
What did Sasha say compliance tends to drive?
c. And those controls shouldn't be a check mark. See Compliance drives engineering controls.
-
Who should decide that private data goes public, according to Sasha?
b. An adversary, an attacker or an honest mistake should never make that call. See Investors, breaches and private lives.
-
What did the hosts promise for the next episode?
a. The SOC 2 guides are on our blog. See Next up: SOC 2.
Are you ready for the first question?
Eight questions on whether you’re ready when a buyer asks about compliance before the first conversation, built from the episode. Each tip links the section behind it.
Scorecard · eight questions
Are you ready for the first question?
Answer for the deals you're working on today. If two answers fit, pick the lower one.
-
If a buyer asks for your SOC 2 report or ISO certificate before the first call, what do you send?
- Nothing yet
- A plan with a date
- A current report or certificate
The question now comes before the first conversation. See The question now comes first.
-
How long would an 800-question security questionnaire take you?
- We'd start from scratch
- Days, with engineers pulled in
- Hours, from answers we keep current
The questionnaire is one of the moments the series was for. See Who should listen.
-
Do you know which standards your market expects?
- Not yet
- The general ones
- The general ones and our vertical's own
Some standards cut across markets, and some belong to one. See Every vertical has its own.
-
Do you know what customer data you process, save, store and back up?
- Not fully
- For our main systems
- Yes, written down and current
That data is a piece of the customer's business. See A piece of their business in your hand.
-
Do your security controls run in engineering, or live in documents?
- Mostly documents
- Some of each
- They run, and we can show them
A control is more than a check mark. See Compliance drives engineering controls.
-
Have you decided when to start, and priced the wait?
- Not yet
- We decided without numbers
- Yes, with the cost of waiting
Waiting can be right, and it has a price. See Open the door, or close the deal and the calculator.
-
Do decisions made across the company follow one standard?
- No
- In some teams
- Yes, one standard everywhere
A founder can't be in every decision. See Standards that scale your decisions.
-
Could you explain your security to an investor?
- No
- Roughly
- Yes, with the controls and the plan
There's always an investor in any venture. See Investors, breaches and private lives.
The question will come before you're ready. Start with the standard your buyers ask for most, and a list of the customer data you hold.
Some answers exist, but a report request or a long questionnaire still stalls a deal. Put a date on the report and keep the answers current.
Buyers get answers before they ask. Keep the controls running, and add your vertical's own standard when deals need it.
What does waiting cost?
Jon said waiting is sometimes the right answer, with a price to pay. This calculator puts a number on that price: the revenue at risk each month you wait for a report that buyers ask for.
Calculator
What does waiting cost?
Four numbers: deals a quarter where the buyer asks for SOC 2 or ISO, the first-year value of a deal, the share of those deals that stall or are lost without a report, and what it costs to start now.
At 3 deals a quarter that ask for a report, worth $40,000 each in the first year, with 30% stalling or lost without one, each month of waiting puts $12,000 at risk, $36,000 a quarter. Starting now costs $60,000, about what 5.0 months of waiting put at risk.
The calculator counts revenue at risk. Some stalled deals close later, and some deals ask for more than a report. The default numbers are placeholders, yours to change. The months figure stops at 120.
From PCI DSS to the Govern function
The standards in the episode, the privacy laws next to them, this show, and our SOC 2 guides. Filter by topic.
Timeline
From PCI DSS to the Govern function
- PCI DSS 1.0
The first version of the card data standard (Wikipedia).
- ISO/IEC 27001
First published by ISO and the IEC (Wikipedia).
- The PCI Security Standards Council
Set up by five card brands to govern PCI DSS (Wikipedia).
- HITRUST
Formed in response to healthcare data breaches (Wikipedia).
- NIST Cybersecurity Framework
Developed by NIST (Wikipedia).
- GDPR adopted
By the European Parliament and the Council (Wikipedia).
- Trust Services Criteria
The AICPA sets the five categories behind SOC 2 (Wikipedia).
- NIST CSF 1.1
Adds supply chain risk management (Wikipedia).
- GDPR takes effect
Two years after adoption (Wikipedia).
- CCPA adopted
California's privacy law, with many similarities to GDPR (Wikipedia).
- FIPS 140-3
First published, to replace FIPS 140-2 (Wikipedia).
- ISO/IEC 27001:2022
The latest revised edition (Wikipedia).
- Episode 27
Colin Bitterfield on SOC 2 in six months (episode page).
- An ISO/IEC 27001 amendment
On climate action changes (Wikipedia).
- Episode 37
The Founder's Guide to Compliance opens (Podbean, transcript).
- NIST CSF 2.0
Adds Govern as a sixth core function (NIST, on this page).
- Episode 52
Suha Can on SOC 2 and ISO 42001 (episode page).
- Episode 64
Daniel Marashlian of Drata on a SOC 2 request (episode page).
- What Even Is a SOC 2?
Our plain-English guide (blog).
- FIPS 140-2 end date
Its validations move to the Historical List (Wikipedia).
- SOC 2 Type 1 vs Type 2
Which report enterprise buyers require (blog).
- What Is a DDQ?
Due diligence and security questionnaires (blog).
- How Long Does a SOC 2 Audit Take?
Timelines, phases and a five-month case study (blog).
- SOC 2 in Progress?
How to tell customers and keep deals moving (blog).
What to do this week
Five things, in the order of the episode.
- Price the wait. Count the deals that asked for SOC 2 or ISO last quarter, and run them through the calculator, as in Open the door, or close the deal.
- Have an answer for the first question. Decide what you send when a buyer asks before the first call: a report, or a plan with a date, as in The question now comes first. SOC 2 in Progress? covers the second case.
- Write down the data you hold. List what you process, save, store and back up for customers, as in A piece of their business in your hand.
- Find your vertical’s standard. Check which standards cut across your market and which belong to it, as in Every vertical has its own and The standards, one by one.
- Get help with it. Our SOC 2 Type 2 team gets you the report buyers ask for, and HITRUST Certification covers healthcare. vCISO Services gives you a security leader to make these calls with you, and FedRAMP Readiness prepares you for federal buyers. If you want to talk it through, book 15 minutes with us.