SOC 2 Demystified: The Key to Closing Enterprise Deals with Vanta CEO Christina Cacioppo

Thank you so much. Thank you for having me. Excited to be here today. Um, so I'm Christina, CEO of Vanta. Uh, Vanta helps growing SaaS startups, companies like yours, automate security and compliance. And so today we're going to talk about how SOC 2— what is SOC 2 compliance and how you can use it to help you close larger deals and ultimately grow your business. So first agenda for you, we're going to go fast, um, but brief intro, which we just did, talk through first reasons for SOC 2, like why you would want to go, go through one of these audits and get one of these reports. Then we'll sort of dive into what the report actually is, what the process is, go through what the report is, the audit timeline, then turn to using SOC 2 to scale, so how you can use it to grow your business, and finally wrap up with some takeaways from some of our customers and how they've really been successful in growing their businesses with SOC 2 and with compliance. So to start, intro. I'll go over a bit of my background from before I started Vanta. First job was at Union Square Ventures, an early-stage venture capital firm in New York City. Really liked it, but realized I kind of fundamentally wanted to build things. So I left venture, learned to code and build products, built a bunch of stuff, none of which you've ever heard of, none of which really got off the ground. So then I took a job at Dropbox. Worked as a product manager on Dropbox Paper. And while I was there trying to get enterprise adoption for Paper, you know, really distribute this like new, you know, document product to Dropbox's customers, I realized those enterprise customers wouldn't take a founder's or a PM's word that their product was safe and that it protects customer data. They really wanted proof. And in fact, I quickly realized this problem wasn't unique to me at Dropbox as a PM, as any of that. It was just a really common issue that comes up when a startup is trying to sell into the enterprise. And then like sort of the progression where you'd have an initial sales call, it went great. You go through all the opportunity stages, deal looks really promising, and you'd like see the finish line, it's in sight, only to have your deal stopped in its tracks when your customer and your prospects ask you to provide proof of your security practices. They ask you for a SOC 2 report. They ask you for lengthy security questionnaires. They tell you, you have to go through this dreaded security review. And we've seen this demand for SOC 2 happen a lot now. And it's not just when you're selling to big enterprises. Again, Dropbox, kind of a big enterprise itself, would run into this. Um, one of the Vanta customers, one of our customers, Link Squares, put it really well in a blog post they wrote after they got their SOC 2 report. And they said, every SaaS vendor should have a SOC 2 Type 2 report that they're ready to show you. And if you don't, you should insist on them achieving it as part of your contract. And we've just kind of seen that happen more and more. So SOC 2 is being written into these big contracts. And as you can probably tell, you really don't wanna be the person Googling, what is a SOC 2, when you've just been asked to give somebody a SOC 2, give them yours. So now that I've sufficiently scared you, let's go over what a SOC 2 is and what's involved in getting one. At its simplest, a SOC 2 is a long report. It's really just a big PDF. Maybe 100 pages, that's put together by a third-party auditor from the AICPA. And the idea of SOC 2 is it's a general answer to the question of, are you secure? So now going a level deeper, there's 4 sections of a SOC 2 report that we'll walk through. And actually on the, on the left of the slide, you can see we're actually using Banta's SOC 2, like the one we got as a reference to just go through the sections. So section 1, Independent service auditor's report. Really, this section is just the auditor saying that the company is in good shape per the SOC 2 standard, provided that all the information the company gave them is accurate. So it's saying, hey, I'm an auditor. Given what the company told me and it's accurate, I feel good. This company's in good shape. Section 2 is an assertion of Vanta's management, or, you know, the company's management. So it's, you know, your company, Vanta, who whoever the subject of the report is saying, hey, we gave the auditor accurate information. Everything looks good. Section 3 is, in this case, Vanta's description of Advanta Platform. So it's us describing our software. It's about 15 pages of prose, so sentences, paragraphs, kind of describing all of our security practices, everything we do to stay in good shape from a security perspective and per the SOC 2 standard. And then finally, Section 4 is the meat of the report. That section is a collection of all of Vanta's commitments and specifically what we do to meet these commitments. So for instance, we might say something like, hey, Vanta securely stores customer data. So that's our commitment. And then we'll go through ways we meet it. So maybe it's, you know, we encrypt databases at rest. We make sure all employee laptops that have access to customer data are encrypted. Things like that. And each of those are called controls. And so in compliance speak, we can sort of think of them as commitments and security practices, like things we do. And so that section of the report is, you know, high-level commitment, specific security practices, and then sort of the auditor sign-off. So the auditor will say, hey, I looked and saw that the company encrypts all the databases at rest. They actually do this. You can, you can trust it. So, When you provide a customer with your SOC 2 report, they can see all the commitments you're making and all the ways you're upholding them and what the auditor thought, like how well you're doing. So you might be wondering how long it actually takes to get a SOC 2 report, and the answer is unfortunately a little bit of it depends, but depends on a lot of things— company size, all that. But really, the process of completing an audit happens in two phases. First, You have to get audit ready. So this includes deciding which controls you wanna track, basically what you wanna claim, what commitments you wanna make. And then you do a gap assessment. You can do this internally, you can do it externally, get a consultant or auditor to help you to figure out how close you are to being able to make those claims. So do you actually encrypt data in all your databases at rest? Do you actually kind of do these practices you wanna uphold? That process can take 1 to 3 months to do on your own. Again, sort of depends how big your company is, how complex it is, what sort of commitments you wanna make. A service like Vanta can help speed this up, up this process to help you get prepped and ready for audit. So just as one example, with Vanta, we wrote a bunch of policy templates so you have a starting point for deciding what security policies you wanna implement and how to word them. And then we also kind of integrate with tools like your cloud provider, task tracker, version control to automatically put together pretty quick and comprehensive gap assessment. So that's the first phase. The second phase of an audit is actually working with the auditor to prove that you're following the controls you say you are. So this could entail providing a bunch of manual evidence for the auditor in the form of screenshots. So for instance, you could get on a video call with them where they ask you to share your screen. And let's say you wanted to show them that your databases are encrypted at rest. So, you know, they might ask you to log into AWS, navigate to the database page, show them that all the, you know, databases are in fact encrypted. They see that UI. You'll take a bunch of screenshots of that, send those to the auditor. And so that's, that's how you kind of prove that your controls are in place. So you can imagine, with kind of hundreds of controls, there's, there's a lot of screenshots to be generated. And again, automation can help here. Vanta automatically correct— collects the vast majority of a lot of the evidence you need for one of these audits. So, you know, if you say all your, your new hires receive background checks, Vanta can integrate with the— your background check service to do those checks and to show that they happen, so you don't have to submit every employee's background check manually. All in all, automation like Vanta can save you several months, even two to three quarters' worth of time in preparing for and completing a SOC 2 audit. So now we've talked a little bit about what the audit entails, and as I alluded to earlier, SOC 2 can be a very valuable tool for for closing deals and avoiding the dreaded loop of endless security questionnaires. But you don't need to be reactive in messaging your SOC 2. In fact, we'd recommend you be proactive about it. A lot of our customers choose to share their SOC 2 report as soon as they learn there's a security review in the sales cycle. It's a great way to show your commitment to security without ever being asked. And again, proactive, you're on top of things, this is something you care about, and you're demonstrating that to your customers and prospects. And then once you get your SOC 2 report, you can share the news on social media, in a blog post, via PR, all of that. We provide customers a badge that they can place on their website to demonstrate to their potential customers that they're SOC 2 compliant, and this is fundamentally a priority. Security and protect— protecting customer data is a priority for their organization. So the key takeaway here is to think of SOC 2 not just as a box you need to check, but as a key piece of your marketing and sales collateral. Finally, here's a few examples of how Vanta customers have spoken about their SOC 2 in marketing materials. Again, things other companies just like yours are doing that have proven for them to be super effective. What I love about these quotes is that they really highlight the two reasons you might get a SOC 2 as a company. First and foremost, a SOC 2 can help you hold your organization accountable to a very high standard of security, and ensure that your customer's data is well protected. And second, a SOC 2 offers a streamlined standardized way to communicate these rigorous security practices to new and existing customers. So now let's close with a few key takeaways about SOC 2. First, we talked about what a SOC 2 is. It's a way to show and validate with a third-party auditor that you protect customer data. Second, we talked about your SOC 2 journey and when to start it. And the answer is start it before you need to. The cost of losing deals, slowing down, answering long security questionnaires will almost always outweigh the cost of conducting a SOC 2 audit. And then finally, once you have a SOC 2 audit and you've gotten that complete, you've gotten that report, be loud and proud about it. Share the report proactively with prospective customers and message your SOC 2 as part of your marketing and sales collateral. So in a minute, I'll open the floor to questions, and we also invite you to come and ask questions at our booth, which opens in about 10 minutes. You should see a link to chat, link in the chat to the booth. And we also have an offer of 20% exclusive, 20% off Vanta, exclusively available to SaaStr attendees. If you go to vanta.com/saastr, you could take advantage of that. With that, happy to open it up for any questions. Thank you so much.

Nice job, Christina.

Great. Should we start with the Q&A?

Good.

By way of introductions, my name is Eric Martin. I lead the sales team here, mostly here just making sure that we can get these questions answered. Let's see, we've got one that is just, I guess the question is, can you speak a little bit more about the SOC 2 Type 1 and just one more time reiterate kind of why companies are able to get that faster than a Type 2?

Yeah, for sure. So we sort of, we glossed over this a little bit, but there's two types of SOC 2 reports. There's a Type 1 and a Type 2. So brief terminology overview, a Type 1 report is sort of the equivalent of show— showing an auditor screenshots or data for one day. And the auditor writes a report saying, you know, hey, on Wednesday, I checked everything and everything looked good on Wednesday. A Type 2 report covers a longer time period, 3 to 6, 9 months. So that's more screenshots, more evidence gathering, but then you end up with a stronger report. On the other side, where an auditor says, hey, I looked at the security practices of this company for a half year. And they kept doing the same things they said they did. They're probably actually a really secure company. So that's Type 1 versus Type 2. So Type 1, you can get faster. And you still have to get ready for both, right? You still have to figure out your controls and your commitments, get all that in shape. But you only need 1 day's worth of data for a Type 1. So you only need to wait for kind of 1 day there, versus a Type 2, over 3 to 6 months, you just have to wait for that time to elapse. So you can get that one faster, which we find, at least folks who use Fanta, if they're like particularly pressed for a SOC 2, right, like they are kind of in Googling what it is so they can close the deal, they tend to prefer Type 1s first.

Cool. Yeah, that makes sense. Another question here is, I mean, I guess in simpler terms, what types of companies might need a SOC 2?

For sure. So we've had an increasing number of customer— of companies, basically. But a good rule of thumb, right, is if you're a software provider, um, you are running software in the cloud. So it could be SaaS, it could be not, but it's not on-prem, right? It's cloud software. And you just are storing data that makes your customers nervous, um, whatever that is, from whether it's emails to, you know, tasks to product roadmap to sales data, whatever. Um, you'll tend to get asked for a SOC 2 increasingly much. So it's really broad, but, but again, kind of, if you could ask for security questionnaires, if you have prospects that care about your security, you'll probably need SOC 2.

Yeah, I can chime in on this and just say it's, it's mostly at this point unpredictable in terms of who might need SOC 2. We have services providers, we have, you know, fintech and edtech, you know, cloud-based VC-backed startups, and just the other day I was chatting with a handful of our audit partners who are saying that now they are being asked to go provide a SOC to on behalf of their clients. Another question we have here is, do we have auditors who can run audits online, as in perform an audit without coming to your office?

Which—

Yeah, we do. So we've seen this increasingly much where in the past, auditors would want to, you know, come to the office, you know, see, check out, meet the team in person, all of that. And now some, some of it's software, you know, like Vanta, some of it's COVID, but these audits run 100% online. And so there isn't an auditor in your office, even if you are working from an office these days.

Yeah. Traditionally, right, companies would have to show that they are demonstrating kind of the right safety precautions in terms of like kind of the physical space where they exist in the world in which we currently live in, and the world in which things might live in the cloud, and/or you don't have filing cabinets with sensitive documents. Most of these auditors have kind of, you know, rightfully adjusted how they think about, you know, what a company might be required to show or demonstrate in the physical space.

Yeah, it's a great point. Like there's a COVID angle here, but there's stuff that predates COVID too, whereas, you know, 10, 20 years ago, you might literally have had customer data in file cabinets. And, you know, even in 2019, if you had an office, you probably didn't have customer data in file cabinets there. It was all on people's laptops.

This is a good question. I, I probably know the answer to this maybe more than Christina, but, uh, which team members need to work on a SOC 2 project? Developers, security, support? And how much time do they generally need to allocate for this?

Oh, okay, so I'll give all of the above, and then do you want to take this one?

Sounds like you're excited for this one. Yeah, I think at large, when we work with companies, the first thing that we ask, or we want to make sure, is that they have someone who is kind of assigned to lead the project, right? So If it's a 1 to 20 person company, that might be a co-founder who just kind of has an executive overview. If it's a, you know, 21 to 50 person company, you know, it may be a dedicated project manager and/or, you know, someone like a technical leader per se. At large though, you know, this is the role of kind of our customer success team is helping you quarterback your way through these requirements. And we like to encourage folks if they can to pull in someone with some technical domain expertise, and this is someone who has, you know, surface-level familiarity with kind of how you use your cloud infrastructure, your version control system, your API, your, you know, identity provider, etc. But then also someone to help with the cat herding, right? So a big part of kind of getting a SOC 2 is making sure that your employees all do certain things, right? So maybe it's making sure that they've done annual security training. You may have a control tied to your employees doing background checks. Accepting certain policies, etc. And so if you can take a multi-pronged approach towards this, you know, that's when we see companies going from zero to SOC 2 ready in a matter of days instead of weeks or months.

It's a good question.

Um, let's see. All right, we have a unique question here about, um, HIPAA. Um, let's see. We are obligated to follow HIPAA requirements, which includes pretty extensive training requirements. It's a good point. So when companies are using Vanta to also kind of streamline the HIPAA security rule, companies— employees are not only required to do kind of general security awareness training, but also HIPAA training, which we have partners that offer that actually for free for Vanta customers. And so the question is, does Vanta platform incorporate those training materials? I realize I just answered that. We don't— we haven't built training materials in-house. You know, that's low-hanging fruit that, you know, there are other partners who we work with who do that and enjoy doing that.

That is not our core focus today.

But high-level, I guess, yes, there's, there's Vanta help available for HIPAA, increasing amounts, including directing you to good training resources on that front too.

We have a couple questions here tied to, like, at large, like, What's the ballpark cost to run an audit?

Oh yeah.

You have to get your SOC 2 report.

Yeah. So look, there's a really big range. I mean, the range we, we generally start with is $10,000 to $80,000. That's so huge as to kind of be hard to think about. So I'll try to break it down. So, okay, let me actually start with that. So what you're definitely going to pay is you're definitely going to pay for the audit itself, like for the auditor to come in, look at your practices, evaluate them, write the report. Depending on how large you are as a company, that can be $10,000 at the very, very low end, up to, you know, $50,000 at the high end. Um, low end, high end depends on what— which firm you choose to use and how big your company is. So that you're definitely going to pay. Then there's all sorts of kind of readiness and prep and additional tools you can choose to use, and I'll walk through them, but really high level. This is just a trade-off between, you know, sort of buy versus build, right? Like, how much do you wanna develop this expertise in-house and spend your team's time on it versus pay someone else to do it? So just categories of things there. There's stuff like control setting, like what are your commitments? Like, what is the list of 100 things that we wanna commit to as a company that adheres to the SOC 2 standard? So you can figure that out yourself. You can pay someone to do that. You can work with a tool like Vanta, where we'll help you through that. So there's that piece that'll cost, $10,000 to $20,000, call it. There's things like policy writing. You've got to write a lot of policies. Again, write these in-house, partner with an external security consultant, use something like Vanta. And then there's just a lot of security tools you can buy along the way if you want. So one of the examples used in the talk was laptop encryption. You know, you can encrypt— you can just ask everybody to encrypt all their laptops and ask everybody to take screenshots and send them to you. Or you can use a laptop management tool that'll keep you up to date on everybody's laptops. And it doesn't mean you have to, to Eric's point, herd all the cats and go get people to do this. So there's just tools like that you can buy. So really high-level range, like, again, $10,000 to $80,000, $90,000 probably. But you're definitely going to pay for the audit itself. And then there's a whole host of tools, services, things like Vanta you can buy to make it easier and faster for your team to get there. Or you can do the work yourself, take longer, but you'll save more cash. So it's one of those sort of trade-offs for you.

I will say that when you work with a solution like Vanta, there's reasons of independence. You should be expected to sign two dotted lines. Uh, and what I mean is you're gonna pay for the software, and then you also have to separately sign an agreement with the auditor themselves. It's worth highlighting that, you know, a solution like Vanta is a— we're a SaaS model, and so there's this recurring fee. Your SOC 2 report is only good for 12 months. And so for better or worse, for better for our business model, I guess, you have to renew this report every 12 months. From an audit standpoint, you know, when you sign an agreement with an auditor, that is effectively a one-time, you know, agreement, right? So it's not uncommon for companies to switch auditors from report to report. Hopefully, you find an auditor who you trust and you like, And, you know, in the situation where you lean into a tool like Banta, right, you know, these auditors are going to, by and large, kind of file your report leveraging information and raw data found within the solution. But if for one reason or another, you know, you want to go audit shopping, that's something you can do, you know, on an annual basis.

Another question is, Christina, what are some things that companies can do on their own to become kind of more SOC 2 ready before they actually kind of pull the trigger on either an audit or a solution like, like Bento?

Yeah, for sure. So a really high-level guiding principle is just like, if you know of good security practices from an engineering perspective, from an operational perspective, do them, 'cause those will tend to be sort of SOC 2 things. So a few good ones that, you know, we see companies do is, Putting two-factor on everybody's accounts, so having, you know, on email, on version control, on cloud infrastructure, on all of that, just, it's a little bit of friction, but it actually just takes away this whole class of security vulnerabilities of, you know, people getting phished or accounts getting broken into. So you just set that up early and by default, it gets really easy. For engineering teams, a good one to start, two actually good ones to start early. One is code review. If you just get your team used to reviewing each other's code and kind of blocking commits on code review, again, a little bit more friction, that just becomes a cultural practice that is so much easier to scale versus having a, you know, 50-person engineering team and then needing to implement code review and change that culture just ends up being really hard. So that's a good one to start early. The other engineering-specific one I'll mention, just because it pays lots of dividends, is using some sort of infrastructure as code tool. So like CloudFormation or Terraform, or just getting in the practice of being able to set up and kind of tear down and change your infrastructure through code that you can then code review makes your SOC too better and easier and also hopefully kind of, you know, bolsters your engineering team, too. So that tends to be something that if you can put in place early, there's less thrash, there's less change, and you just kind of reap the dividends forevermore.

Final question, 10 seconds. What's with the llama?

Yeah. Look, every company, I think, has its own culture. And everything, honestly, I've ever worked on has had sort of an animal. Llamas, guard llamas, are very special to us at Vanta. We, you know, the company's mission is truly to to secure the internet and protect consumer data. And we think llamas are a great way to rally around helping us do that.

Awesome. Thank you so much. Thanks again, Christina.

And thanks again, everyone, for joining us today.

Thanks, guys. Meet them over at the lounge. They can answer some of your questions. And check them out. Thank you, Christina. Thank you, Eric. We appreciate it. Thank you so much. Thank you very much. It's been great. Have a good one, guys.