A cybersecurity expert warns small firms against over-investing in compliance. A 30-person company spent $500,000 on SOC 2 certification it didn't need. Instead, focus on basics: use client-controlled SharePoint for files, never download client data, and carefully check emails before sending.
They'll probably ask you.
They might ask. But having an expert that can help you navigate that, like I guarantee that both of you from a customer will have a request. Do you have a SOC 2 or an ISO? And the right answer isn't always, because Cody, you've helped some firms spend $500,000 put in a, you know, for a 30-person company to put in a SOC 2. And while that may be the answer for a specific business, there's probably a more minimum viable product way to show that you have that support and right-size it. Because SOC 2 was really invented for cloud and, you know, software companies to attest that their solution is solid. It's not a ubiquitous one-size-fits-all to validate a boutique consulting company.
But tell me about some of the best practices. You know, so for example, I prefer to set up a SharePoint site with clients that's on their, you know, their instance that I can access. And then when I'm done working with that firm, they can remove my access. I never download the material. Things like that, things like double-checking your emails before you send them. Kind of the ounce of prevention is worth a pound of cure.
