News for hackers. Stuff that matters.

A comment on The Startup CTO's Handbook. Parent comment

Re:The Startup CTO's Handbook by tptacek on Tuesday March 11, 2025 @10:26PM (#43339348)
How are we both right? I think you literally should wait until the last minute to start a SOC2 process.
[ Parent | on HN ]
Re:The Startup CTO's Handbook by rendaw on Tuesday March 11, 2025 @10:42PM (#43339427)
GP's point is that having SSO and protected git branches _is_ starting the SOC2 process.
[ Parent | on HN ]
Re:The Startup CTO's Handbook by tptacek on Tuesday March 11, 2025 @10:48PM (#43339465)
I'm pretty sure that's not what the author meant. Again: those are things you should do regardless of whether you're ever going to get SOC2 (and a lot of startups shouldn't).
[ Parent | on HN ]
Re:The Startup CTO's Handbook by koolba on Tuesday March 11, 2025 @10:47PM (#43339459)
That and having a ticket system (e.g., Jira) to track why you touched prod and you can answer just about every question.
[ Parent | on HN ]
Re:The Startup CTO's Handbook by tptacek on Wednesday March 12, 2025 @06:19PM (#43348253)
We don't have that, and didn't need it for SOC2.

(We have other ways of tracking prod changes, but our auditors don't know anything about them.)

[ Parent | on HN ]