The Startup CTO's Handbook

Re:The Startup CTO's Handbook by rendaw on Tuesday March 11, 2025 @10:42PM (#43339427)

GP's point is that having SSO and protected git branches _is_ starting the SOC2 process.

[ Parent | on HN ]

Re:The Startup CTO's Handbook by tptacek on Tuesday March 11, 2025 @10:48PM (#43339465)

I'm pretty sure that's not what the author meant. Again: those are things you should do regardless of whether you're ever going to get SOC2 (and a lot of startups shouldn't).

[ Parent | on HN ]

Re:The Startup CTO's Handbook by koolba on Tuesday March 11, 2025 @10:47PM (#43339459)

That and having a ticket system (e.g., Jira) to track why you touched prod and you can answer just about every question.

[ Parent | on HN ]

Re:The Startup CTO's Handbook by tptacek on Wednesday March 12, 2025 @06:19PM (#43348253)

We don't have that, and didn't need it for SOC2.

(We have other ways of tracking prod changes, but our auditors don't know anything about them.)

[ Parent | on HN ]