SOC 2 Demystified: The Key to Closing Enterprise Deals with Vanta CEO Christina Cacioppo

She's here today to talk about SOC2 demystified, the key to closing enterprise deals with Fanta. She has her social media handle up for you guys, so of course you can follow her or tweet at her later on, but please make sure. Definitely. Feel free to put in Q and A. It's down at the bottom and we'd love to have it as we go on. But without further ado, I'm going to pass it over to Christina.

Welcome.

Thank you so much. Thank you for having me. Excited to be here today. So I'm Christina, CEO of Vanta. Vanta helps growing SaaS, startups, companies like yours, Automate security and compliance. And so today we're going to talk about how SoC2, what is SoC2 compliance and how you can use it to help you close larger deals and ultimately grow your business. So first agenda for you, we're going to go fast, brief, brief intro, which we just did, talk through. First, reasons for SOC 2, like why you would want to go through one of these audits and get one of these reports. Then we'll sort of dive into what the report actually is, what the process is, go through what the report is, the audit timeline, then turn to using SoC2 to scale so how you can use it to grow your business and finally wrap up with some takeaways from some of our customers and how they've really been successful in growing their businesses with SoC2 and with computers compliance. So to start intro, I'll go over a bit of my background from before I started Vanta. First job was at Union Square Ventures, an early stage venture capital firm in New York City. Really liked it, but realized I kind of fundamentally wanted to build things. So I left Venture, learned to code and build products, built a bunch of stuff, none of which you've ever heard of, none of which really got off the ground. So then took a job at Dropbox, worked as a product manager on Dropbox Paper, and while I was there trying to get enterprise adoption for paper, you know, really distribute this like new document product to Dropbox. Those customers, I realized as enterprise customers wouldn't take a founder or a PM's word that their product was safe and that it protects customer data. They really wanted proof. And in fact I quickly realized this problem wasn't unique to me at Dropbox as a PM as any of that. It was just a really common issue that comes up when a startup is trying to sell into the enterprise. Then like sort of the progression where you'd have an initial sales call, it went great you go through all the opportunity stages, deal looks really promising and you'd like see the finish line. It's insight only to have your deal stopped in its tracks. When your customer and your prospect ask you to provide proof of your security practices, they ask you for a SOC 2 report. They ask you for lengthy security questionnaires. They tell you you have to go through this dreaded security review. And we've seen this demand for SOC2 happen a lot now. And it's not just when you're selling to big enterprises. Again, Dropbox, kind of a big enterprise itself would run into this One of the Vanta customers, one of our customers, Linksquare, put it really well in a blog post they wrote after they got their SOC 2 report. And they said every SaaS vendor should have a SOC 2 type 2 report that they're ready to show you. And if you don't, you should insist on them achieving it as part of your contract. And we've just kind of seen that happen more and more. So SOC2 is being written into these big contracts and as you can probably tell, you really don't want to be the person googling what is a SOC2 when you've just been asked to give somebody a SOC2, give them yours. So now that I've sufficiently scared you, let's go over what a SoC2 is and what's involved in getting one. At its simplest, a SoC2 is a long report. It's really just a big PDF, maybe 100 pages that's put together by a third party auditor from the AICPA. And the idea of SoC2 is it's a general answer to the question of are you secure? So now going a level deeper, there's four sections of a SOC 2 report that we'll walk through. And actually on the left of this slide you can see we're actually using Banta SoC2 like the one we got as a reference to just go through the sections. So section one, Independent Service Auditors report. Really this section is just the auditor saying that the company is in good shape per the SoC2 standard, provided that all the information the company gave them is accurate. So it's saying, hey, I'm an auditor, given what the company told me and it's accurate, I feel good, this company's in good shape. Section 2 is an assertion of Vanta's management or you know, the company's management. So it's, you know, your company, Vanta, who, whoever the subject of the report is saying, hey, we gave the auditor accurate information. Everything looks Good. Section three is in this case Vanta's description of Advanta platform. So it's us describing our Software. It's about 15 pages of prose, so sentences, paragraphs, kind of describing all of our security practices, everything we do to stay in good shape from a security perspective and per the SoC2 standard. And then finally section 4, the meat of the report. That section is a collection of all of Vanta's commitments and specifically what we do to meet these commitments. So for instance, we might say something like, hey, Vanta securely stores customer data. So that's our commitment and then we'll go through ways we meet it. So maybe it's, you know, we encrypt databases at rest, we make sure all employee laptops that have access to customer data are encrypted, things like that. And each of those are called controls. And so in compliance speak. But you can sort of think of them as commitments and security practices, like things we do. And so that section of the report is, you know, high level commitment, specific security practices, and then sort of the auditor sign off. So the auditor will say, hey, I looked and saw that the company encrypts all the databases at rest. They actually do this. You can, you can trust it. So when you provide a Customer with your SoC2 report, they can see all the commitments you're making and all the ways you're upholding them and what the auditor thought, like how well you're doing. So you might be wondering how long it actually takes to get a SOC 2 report. And the answer is, unfortunately, a little bit of it depends, but depends on a lot of things, company size, all that. But really the process of completing an audit happens in two phases. First you have to get audit ready. So this includes deciding which controls you want to track, basically what you want to claim, what commitments you want to make, and then you do a gap assessment. You can do this internally, you can do it externally. Get a consultant or auditor to help you to figure out how close you are to being able to make those claims. So do you actually encrypt data in all your databases at rest? Do you actually kind of do these practices you want to uphold? That process can take one to three months to do on your own. Again, again, sort of depends how big your company is, how complex it is, what sort of commitments you want to make. A service like Vanta can help speed this up up this process to help you get prepped and ready for audit. So just as one example, with Vanta, we wrote a bunch of policy templates so you have a starting point for deciding what security policies you want to implement and how to word them. And then we also kind of integrate with tools like your cloud provider, task tracker, version control to automatically put together a pretty quick and comprehensive gap assessment. So that's the first phase. The second phase of an audit is actually working with the auditor to prove that you're following the controls you say you are. So this could entail providing a bunch of manual evidence for the auditor in the form of screenshots. So for instance, you could get on a video call with them where they ask you to share your screen and let's say you wanted to show them that your databases are encrypted at rest. So, you know, they might ask you to log into aws, navigate to the database page, show them that all the databases are in fact encrypted. They see that ui, you'll take a bunch of screenshots of that, send those to the auditor. And so that's, that's how you kind of prove that your controls are in place. So you can imagine with kind of hundreds of controls, there's, there's a lot of screenshots to be generated. And again, automation can help. Here, VANTA automatically correct collects the vast majority of a lot of the evidence you need for one of these audits. So, you know, if you say all your new hires received background checks, VANTA can integrate with your background check service to do those checks and to show that they happen so you don't have to submit every employee's background check manually. All in all, automation like Vanta can save you several months, even two to three quarters worth of time in preparing for and completing a SOC 2 audit. So now we've talked a little bit about what the audit entails. And as I alluded to earlier, SOC2 can be a very valuable tool for, for closing deals and avoiding the dreaded loop of endless security questionnaires. But you don't need to be reactive in messaging your SoC2. In fact, we recommend you be proactive about it. A lot of our customers choose to share their SOC2 report as soon as they learn there's a security review in the sales cycle. It's a great way to show your commitment to security without ever being asked. And again, proactive. You're on top of things. This is something you care about, and you're demonstrating that to your customers and prospects. And then once you get your SOC2 report, you can share the news on social media in a blog post via pr. All of that we provide customers A badge that they can place on their website to demonstrate to their potential customers that they're SOC 2 compliant. And this is fundamentally a priority. Security and protecting customer data is a priority for their organization. So the key takeaway here is to think of a SoC2 not just as a box you need to check, but is a key piece of your marketing and sales collateral. Finally, here's a few examples of how Vanta customers have spoken about their SoC2 and marketing materials. Again, things other companies just like yours are doing that have proven for them to be super effective. What I love about these quotes is that they really highlight the two reasons you might get a SoC2 as a company. First and foremost, a SoC2 can help you hold your organization accountable to a very high standard of security and and ensure that your customer's data is well protected. And second, a SoC2 offers a streamlined, standardized way to communicate these rigorous security practices to new and existing customers. So now let's close with a few key takeaways about SOC 2. First, we talked about what a SOC 2 is. It's a way to show and validate with a third party auditor the that you protect customer data. Second, we talked about your SoC2 journey and when to start it. And the answer is start it before you need to. The cost of losing deals, slowing down, answering long security questionnaires will almost always outweigh the cost of conducting a SOC 2 audit. And then finally, once you have a SOC 2 audit and you've gotten that complete, you've gotten that report, be loud and proud about it. Share the report proactively with prospective customers and message your SoC2 and as part of your marketing and sales collateral. So in a minute I'll open the floor to questions and we also invite you to come and ask questions at our booth, which opens in about 10 minutes. You should see a link in the chat to the booth. And we also have an offer of 20% off Vanta exclusively available to Saster attendees. If you go to vanta.comsaster you could take advantage of that. So with that, happy to open it up for any questions. Thank you so much.

Nice job, Christina. Great.

Should we start with the Q and.

A by way of introductions? My name is Eric Martin. I lead the sales team here, mostly here. Just making sure that we can get these questions answered. Let's see, we've got one that is just, I guess the question is can you speak a little bit more about the SoC2 Type 1 and just one more time, reiterate kind of why companies are able to get that faster than a type 2?

Yeah, for sure. So we sort of, we glossed over this a little bit, but there's two types of SOC2 reports. There's a type 1 and a type 2. So brief terminology overview. A type 1 report is sort of the equivalent of showing an auditor screenshots or data for one day. And the auditor writes a report saying, hey, on Wednesday, I checked everything and everything looked good on Wednesday. A type 2 report covers a longer time period, three to six, nine months. So that's more screenshots, more evidence gathering, but then you end up with a stronger report on the other side where an auditor says, hey, I looked at the security practices of this company for a half year and like, you know, they kept doing the same things they said they did. They're probably actually a really secure company. So that's type one versus type two. So type one, you can get faster, and you still have to get ready for both, right? You still have to, you know, figure out your controls and your commitments, get all that in shape. But you only need one day's worth of data for a type one. So you only need to wait for kind of one day there versus a type two over three to six months. You know, you just have to wait for that time to elapse so you can get that one faster. Which we find at least folks who use Fanta, if they're like particularly pressed for a SOC 2, right? Like they are kind of in googling what it is so they can close the deal. They tend to prefer type ones first.

Cool. Yeah, that makes sense. Another question here is, I mean, I guess in simpler terms, what types of companies might need a SOC to.

For sure. So we've had an increasing number of companies basically. But a good rule of thumb is if you're a software provider, you are running software in the cloud. So it could be SaaS, it could be not, but it's not on prem. It's cloud software. And you just are storing data that makes your customers nervous, whatever that is, from whether it's emails to tasks to product roadmap, to sales data, whatever, you'll tend to get asked for a SoC2 increasingly much. So it's really broad. But again, kind of, if you could ask for security questionnaires, if you have prospects that care about your security, you'll probably need to sock too.

Yeah, I can chime in on this and just say it's mostly at this point unpredictable in terms of who might need to SOC to. We have services providers, we have fintech, and edtech cloud based, VC backed startups. And just the other day I was chatting with a handful of our audit partners who are saying that now they are being asked to go provide a soc to on behalf of their clients. Another question we have here is do we have auditors who can run audits online? As in perform an audit without coming to your office?

Which yeah, we do. So we've seen this increasingly much where in the past auditors would want to come to the office, see checkout, meet the team in person, all of that and now some of its software like Vanta, some of it's Covid, but These audits run 100% online and so there, there isn't an auditor in your office even if you are working from an office these days traditionally.

Right. Companies would have to show that they are demonstrating kind of the right safety precautions in terms of like kind of the physical space where they exist in the world in which we currently live in and the world in which things might live in the cloud and. Or you don't have filing cabinets with sensitive documents. Most of these auditors have kind of rightfully adjusted how they think about what a company might be required to show or demonstrate in the physical space.

Yeah, it's a great point. There's a Covid angle here, but there's stuff that predates Covid too. Whereas 10, 20 years ago you might literally have had customer data and file cabinets. And even in 2019 if you had an office, you probably didn't have customer data and file cabinets there. It's all on people's laptops.

That's a good question. I probably know the answer to this, maybe more than Christina, but which team members need to work on a SOC 2 project, developers, security support and how much time do they generally need to allocate for this?

Oh, okay, so I'll give all of the above and then do you want to take the fun? Sounds like you're excited for the fun.

Yeah, I think at large, when we work with companies, the first thing that we ask or we want to make sure is that they have someone who is kind of assigned to lead the project. Right. So if it's a 1 to 20 person company that might be a co founder who just kind of has an executive overview. If it's a 21 to 50 person company, it may be a dedicated project manager and, or someone like a technical leader per se. At large though, this is the role of our customer success team is helping you quarterback your way through these requirements and we like to encourage folks if they can to pull in someone with some technical domain expertise. And this is someone who is, has, you know, surface level familiarity with kind of how you use your cloud infrastructure, your version control system, your API, your identity provider, etc. But then also someone to help with the cat herding. Right. So a big part of kind of getting a SoC2 is making sure that your employees all do certain things right. So maybe it's making sure that they've done annual security training. You may have a control tied to your employees, doing background checks, accepting certain policies, etc. And so if you can take a multi pronged approach towards this, you know, that's when we see companies going from 0 to SoC2 ready in a matter of days instead of weeks or months. That's a good question. Let's see. All right, we have a unique question here about hipaa. Let's see. We are obligated to follow HIPAA requirements, which includes pretty extensive training requirements. That's a good point. So when companies are using Banta to also kind of streamline the HIPAA security rule, companies employees are not only required to do kind of general security awareness training, but also HIPAA training, which we have partners that offer that actually for free for Banta customers. And so the question is, does Vanta platform incorporate those training materials? I realize I just answered that we don't, we haven't built training materials in house. You know, that's low hanging fruit that, you know, there are other partners who we work with who do that and enjoy doing that. That is not our core focus today.

But a high level, I guess. Yes, there's Vanta help available for HIPAA increasing amounts, including directing you to good training resources on that front too.

We have a couple questions here tied to like at large, like what's the ballpark cost to run an audit to get your thought through?

Yeah, so look, there's a really big range. I mean the range we generally start with is 10 to $80,000. That's so huge as to kind of be hard to think about. So I'll try to break it down. So. Okay, let me actually start with that. So what you're definitely going to pay is you're definitely going to pay for the audit itself, like for the auditor to come in, look at your practices, evaluate them, write the report. Depending on how large you are as a company, that can be $10,000 at the very, very low end, up to $50,000 at the high end. Low end, high end depends on which firm you choose to use and how big your company is. So that you're definitely going to pay. Then there's all sorts of kind of readiness and prep and additional tools you can choose to use and I'll walk through them. But really high level, this is just a trade off between sort of buy verse, build, right? Like how much do you want to develop this expert, spend your team's time on it versus pay someone else to do it. So just categories of things there. There's stuff like control setting, like what are your commitments? Like what is the list of 100 things that we want to commit to as a company that adheres to the SoC2 standard? So you can figure that out yourself. You can pay someone to do that. You can work with a tool like Vanta where we'll help you through that. So there's that piece that'll cost, you know, 10 to $20,000.

Call it.

There's things like policy writing, you've got to write a lot of policies. Again, write these in house, partner with like an external security consultant, use something like Vanta. And then there's just a lot of security tools you can buy along the way if you want. So one of the examples used in the talk was laptop encryption. You know, you can encrypt, you can just ask everybody to encrypt all their laptops and ask everybody to take screenshots and send them to you. Or you can use a laptop management tool that'll, you know, keep you up to date on everybody's laptops and it doesn't mean you have to, you know, to Eric's point, herd all the caps and go get people to do this. So there's just tools like that you can buy. So really high level range, like again 10 to 80, $90,000 probably. But you're definitely going to pay for the audit itself. And then there's a whole host of tools, services, things like Vanta you can buy to make it easier and faster for your team to get there. Or you can do the work yourself. Take longer but you'll save more cash. So it's one of those sort of trade offs for you.

I will say that when you work with a solution like Vanta, there's for reasons of independence, you should be expected to sign two dotted lines. And what I mean is you're going to pay for the software and then you also have to separately sign an agreement with the auditor themselves. It's worth highlighting that, you know, a solution like Vanta is a SaaS model. And so there's this recurring fee. Your SoC2 report is only good for 12 months. And so for better or worse, for better for our business model, I guess you have to renew this report every 12 months. From an audit standpoint, when you sign an agreement with an auditor, that is effectively a one time agreement. So it's not uncommon for companies to switch auditors from report to report. Hopefully you find an auditor who you trust and you like. And in the situation where you lean into a tool like Banta, these auditors are going to by and large file your report, leveraging information and raw data found within the solution. But if for one reason or another, you know, you want to go audit shopping, that's something you can do, you know, on an annual basis. Another question is Christina, what are some things that companies can do on their own to become kind of more SoC2 ready before they actually kind of pull the trigger on either an audit or a solution?

Like yeah, for sure. So really high level guiding principle is just like if you, if you know of good security practices from an engineering perspective, from an operational perspective, do them because those will tend to be sort of SOC two things. So a few, a few good ones that you know, we see companies do is putting two factor on everybody's account. So having, you know, an email on, version control, on cloud infrastructure, on all of that just, it's a little bit of friction. But it actually just takes away this whole class of security vulnerabilities of, you know, people getting phished or accounts getting broken into. So you just set that up early and by default gets really easy for engineering teams A good one to start. Two actually good ones to start early. One is code review. If you just get your team used to reviewing each other's code and kind of blocking commits on code review, again a little bit more friction, but just becomes a cultural practice that is so much easier to scale versus having a, you know, 50 person engineering team and then needing to implement code review and change that culture sends it being really hard. So it's a good one to start early. The other engineering specific one I'll mention, just because it pays, pays lots of dividends, is using some sort of infrastructure as code tool. So like cloud formation or terraform or just getting in the practice of being able to set up and kind of tear down and change your infrastructure through code that you can then code review makes your SoC2 better and easier and also hopefully kind of, you know, bolsters your engineering team too. So that tends to be something that if you can put in place early, there's less thrash, there's less change and you just kind of reap the dividends for forevermore.

Final question. 10 seconds. What's with the llama?

Yeah, look, every company, I think, has its own culture. And everything, honestly, I've ever worked on has had sort of an animal llamas guard. Llamas are very special to us at Vant.

Sam.