Panel discussion (SaaStr Annual) with Giles House (A-LIGN) and Megan Hester (Cloud Software Group) about using compliance as a growth tactic. They open with a vignette of a lost deal caused by a late request for GDPR/privacy policies and a long PDF security questionnaire, then describe the high-breach threat landscape motivating these requests. Megan explains the pain of filling vendor questionnaires and argues for proactive disclosure (trust center, website docs, FAQs) and aligning SOC 2 evidence to questionnaire answers. They recommend partnering with auditors to map common controls across frameworks (SOC2, PCI, HIPAA, ISO 27001/27701), automating evidence collection, continuous monitoring, and surfacing controls publicly to speed sales and reduce last-minute deal failures. Closing encourages attendees to visit the booth for help.
Chapters
Please welcome to the stage Megan Hester, Senior Director of IT Governance and Business Operations at Cloud Software Group and Giles House Chief Marketing and Product Officer at Align.
Thank you, thank you welcome and congratulations for joining us on a Friday here at Sasta. And thank you to our DJ spinning some great tunes. We appreciate you. We're going to talk about something pretty interesting. We're going to talk about how you can think about compliance and use that as a growth tactic for your industry. So I'm going to set the scene here and just take you on a little journey and imagine it's Wednesday, September 27, 2023 and you've got this beautiful big deal that's to going cooked, it's ready to go, all the red lines are done and then all of a sudden you get a phone call from your champion and she says, slight problem. My IT InfoSec team just told me I need to send you the GDPR policy, the privacy policy and this security questionnaire. But don't worry, it's a very small security questionnaire. It's only about 400 questions long, it should be fine. And oh by the way, it's in PDF. We're not taking any red lines. Spin the clock on. Needless to say, the deal doesn't happen. It's a six figure contract. Maybe it breaks the quarter, maybe the VP of Sales is looking for a job, maybe the funding round doesn't happen. These things all happen and they're unexpected and they're totally avoidable. So with the help of Megan, we're going to talk about how do you avoid that situation, nail the quarter and be compliant at the same time. So why does this happen? Why do people bombard us with these beautiful security questionnaires, these hundred page privacy documents? It's because we're in a very threatening landscape, which is probably not news to you very smart people in the audience. Last year alone there were 4,100 breaches. The impact of those was billions of dollars in the US just alone. And in one case there was a US telco company. We shall not name names. But they've been breached nine times since 2018 with 37 million customer records. That's emails, that's names, that's date of birth, stuff you do not want to give out and you certainly didn't agree to give out when you signed up with that US Telco Australia. Similar problem. I think this company has been breached for the third time. 11 million customer records, pin numbers, Medicare IDs, passport data, driver's license info. The worst possible outcome for people to have that kind of data out there so impactful that they've had to set up 140 million dollar fund to help their customers that have been hacked to sort their lives out and rebuild their identities because it's, it's crushing financially, it's very crushing emotionally when this happens. And it's very important that it doesn't happen. So this is the landscape we're in. This is why we're getting bombarded with these security questionnaires at the last minute. It's why we have these privacy policies. And how do we survive in a landscape against that backdrop of threats and serious bad actors?
Megan, you just described what was my life. Right. Raise your hand if you love filling out security due diligence questionnaires, vendor risk assessments, RFPs, nobody, nothing.
Half a hand.
Yeah, maybe. No, these are not a pleasant experience for anyone. But they're important because imagine you are trusting a SaaS service provider with your data and more importantly, with your customer's data. So you need to have this assurance that you're gonna do exactly what you say you are going to do, right? That you're meeting these minimum standards, you're meeting the security requirements that are generally acceptable. So no one questionnaire looks the same, Right? So those, those 400 page documents that you described, of course they're in PDF format. No one is the same. So what you want to do is really try and put that information up front. Right. Get in front of the questionnaires, get ahead of that by sharing that information before you even get to the RFP stage. Right.
I agree. And some people are probably sitting there thinking, well, I've got a SoC2.
Yeah.
And align. We do SoC2s. We've issued more SoC2s than anybody else in the world. And they're a great seal of approval, if you will. But even with that, you still get peppered with questionnaires, right?
Absolutely, yeah. I think a lot of customers, or particularly those who are reviewing the vendor due diligence, the vendor risk management questionnaire packages, they're not necessarily the information security folks, right? So a lot of people just see, yep, tick the box. Yes, you have a SoC2, but you still have to fill out this questionnaire. And the irony is all of the questions you're seeking in the SOC2 report or in your questionnaire are in the SOC2 report. So it's just trying to match those things up for the customer to help them help themselves.
And I think that's why you get these, these questionnaires that come out of the blue. Because people think, well, I've got this report, that should be fine. Yeah, why are you asking me all these questions? But what you realize and coming from this, from a. Not from the practitioner point of view, but from the sort of business leader point of view, you think, well, why is this the case? And then you realize when you get into it that you can get a Soc 2 from over here.
Yeah.
And it looks completely different to something you can get over here. The depth, the number of controls, all the fun stuff that the SOC 2 looks at. Absolutely be completely different. And you can still get that seal of approval. And I think that's why we get these questionnaires. Right.
We do the same thing for our providers. Right. My vendor risk management team still expects to see a SOC 2 report, still expects to review it. So we sort of have to pass on that, that sort of burden of security assurance. But you're right, not every SOC 2 report reads the same. If one takes the time to read.
Them, and they're great to read, especially if you suffer from insomnia. So, Megan, what would your advice be to somebody that's maybe stepping into this role full time? Maybe they were doing it part time before, and then how would that differ from somebody that's a seasoned pro, such as yourself?
Sure. So I've done it both ways. I've done it the wrong way and done it the hard way. And we figured out really getting that information in front of your customers. Again, if you can get onto your website, technical documentation, if you have security configurations that you can share for your SaaS product, put that out there. If you have answers to your, you know, the common security questions that are found, the answers are found in the SOC2 report. Why not share those? It's not like you're putting your incident response runbook on your website, but really answering those questions so that you can point to those ahead of time. If you can build a trust center, if you can build resources like a blog post or some sort of collateral that speaks to the security and your security practices, all that are built on a SoC2 report or on a series of sys controls or whatever your framework may be.
And speaking of frameworks, you bring up a great point that this problem isn't going to go away.
No.
You have multiple frameworks that people are going to ask you for.
Absolutely.
Some of them are a lot more fun than others. And by fun, we mean a ton more work because there's so many more requirements. So when you think about technology, and we're here at sasta. So we need to talk about technology for a second. What is the role of technology in helping you go from I just need to tick the box now. I realized that just ticking the box isn't enough. And thinking like how do I scale a program and get ahead of these things that the customers are going to ask me for?
Sure. So that's the thing. There are compliance frameworks. Information security and privacy frameworks around the world are proliferating. They're not going to stop. Every government, every industry, every vertical thinks that their data is unique and requires a unique set of controls. The reality of that, we're asking the same question 42 times. So working with your trusted service provider, particularly your auditor, get in the game with them early before those assessments, you'll actually find that when you partner with them, you can find common controls. PCI, HIPAA, SOC2, ISO 2700127701. And the list goes on again. If you, you can answer the question once to solve for many, working with your auditor and your assessor partner, you can make life a lot easier for yourself and your control owners.
And I think exposing it as well, putting that information on your website so people can see it, you've got nothing to hide, they're going to ask you for it anyway. The safe face booth is over here as well. These guys do a great job of helping you do that and taking that information that people are looking at and sharing that with your customers in a controlled fashion. Now some people make a little mistake sometimes and they sort of include passwords and things in the screenshots which you absolutely should not do and you don't need to do. So just be careful. But you should absolutely put this information out there and lean into it. Your, your compliance and security posture, it's not an afterthought. You're going to get asked about it and you can lead with it up front in your sales presentations. You should, you should say, not only do we comply with these frameworks, it's completely thorough. And what's more, you can look at it on our website. Go ahead, dive in, check it out. And I think it's so important that people get that sense from the off because compliance is not a one and done thing that you need to just tick in the box for the year. It's a cultural thing, right?
Absolutely. Continuous monitoring of those requirements is essential so that you're not stuck at your annual audit or your six month audit, scrambling to find evidence. Right. If you can keep it going and keep that posture throughout the year. It just makes life so much easier working with your again, your partner to automate some of those controls too. Just makes it so much easier for everybody, especially your auditor.
There you have it. So Friday afternoon is around the corner. We thank you for listening. Lean into your compliance program and if you need help, come and see us at the booth. Thank you, Megan, so much for joining us.
