Becoming and Staying Compliant as a Startup

Regulatory compliance is no longer associated only with large enterprise organizations. Startups that sell to such enterprises are considered part of their supply chains and are increasingly required to meet the same regulatory standards before serving those enterprises as vendors. Even startups that sell directly to consumers are subject to the same privacy laws right from when they launch their services and sign up their first users.

For this reason, startups are increasingly designing their software delivery platforms on public cloud services that comply with regulations and leverage modern tools designed for implementing regulatory controls. Startup compliance has become achievable and expected when startups transition from the seed stage—when still determining product-market fit—to what’s considered “series-A” stage venture funding, meant for scaling operations.

This article will walk you through recommendations for implementing and maintaining compliance in any startup.

Compliance for Startups

Know Your Stakeholders and Their Expectations

Regulators ask you to be “resilient,” customers want to see a “SOC 2 Type 2 report,” and startup founders just want to “not end up in the news.” Coordinating all this requires a strategic approach even before signing your first business deal.

If you’re a SaaS provider, you should familiarize yourself with the regulatory requirements of your prospective customers, especially if you’re targeting financial, public infrastructure, or healthcare companies. Being prepared to “talk compliance” and discuss your readiness as part of their (potential) supply chain to meet these requirements already puts you high on the list.

For example, you will need to:

• Understand the reporting requirements for each type of incident, such as data breach incidents, to each relevant authority. For instance, the GDPR mandates reporting all personal data breaches to the appropriate authority within 72 hours.

• Get acquainted with the potential stringent requirements of different jurisdictions in which your clients operate if you process any of your clients’ data. The GDPR only allows the personal data of EU citizens to be processed in the US under certain derogations.

• Meet your SLAs, which can include uptime, vulnerability disclosure, and incident response requirements.

• Obtain operating licenses in various jurisdictions before closing a contract.

• Certify your organization or obtain security attestations for certain products (e.g., ISO 27001, SOC 2, PCI DSS).

Have Your Risk Assessment Ready

Whether you have already had a major incident or not, risk assessments should become an ongoing process. Each regulation exists as a framework to address certain risks. For example, the Digital Operational Resilience Act (DORA), applicable to EU-based financial institutions of all kinds, aims to mitigate the risks of systemic downtimes by requiring financial companies—and their IT vendors—to have sound controls for preventing IT security and operational incidents.

Assessing your posture against such regulations reveals areas that you must focus on. Perhaps you don’t perform a complete set of security testing before releasing a new feature of your product. If so, the risk is launching vulnerable software that gets exploited, affecting your customers and (implicitly) your reputation. Another example is if you’re processing personal health information (PHI), and due to insufficient authentication controls, any of your employees might access that information. Even if no disclosure or manipulation occurs, this already represents a regulatory breach.

Knowing your gaps, ranking their likelihood and impact, and prioritizing remediation are needed to improve your compliance and business trust. Risk assessments also create a so-called “defendable position”—essentially the ability to demonstrate due diligence—which can be helpful in the unfortunate event of litigation.

Design, Implement, and Test a Core Set of Compliance Controls

A state-of-the-art control environment takes years to build, but based on your risk assessment results, the priority of each control should be clear.

Controls are strictly related to the risk assessment results. In their absence, at a minimum, you should start with controlling unauthorized access, enforcing encryption, creating acceptable use rules, and setting up an incident management process. There should be a mix of preventive, detective, and corrective controls. Use global standards—such as ISO 27001, SOC 2, and NIST—to obtain insights on best practices for control implementation.

Depending on your service and customer commitments, you may need to get certified against one or more standards. Using their sets of controls, mapping them to your own, and ensuring that your scope is covered will prepare you for the certification audits. (You may certify one product or one area of business, instead of your whole startup.)

Testing controls after their implementation is also a valuable process that gives you an objective assessment of your setup. You bought a software testing tool, but no one is using it? It’s time to improve internal training and enforce change management steps.

Use Suitable Cloud Services for Enforcing Controls

SaaS tools help your startup stay secure, organized, and productive. They’re also a means of ensuring that compliance controls are implemented, and some of these are even inherited directly from the cloud service provider (CSP) and embedded into the product. For example:

• Access Controls: Authentication tools for secure sign-in and directory tools to authorize and manage users and systems

• Network Security: Built-in features of your PaaS/IaaS provider (such as encryption), intrusion detection systems (such as log analysis and integrity checking tools), and intrusion prevention systems (such as the classic firewall)

• Vulnerability Management: Software scanning tools such as Veracode, vulnerability management correlation, and security orchestration tools

• Data Protection: VPNs for tunneling communication, digital rights management software for protecting copyrighted material, data inventory and classification tools, and governance, risk and compliance (GRC) tools

• Software Development: Static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), and infrastructure as code (IaC) tools

Especially for startups, there’s heavy dependency on services. While having a vast variety of vendors cannot be avoided, you can stay compliant if you follow the following practices:

• Conduct Due Diligence: Before selecting a vendor, there are checks you can apply that give you great insights and don’t cost a penny. Some of these are public research on legitimacy and trustworthiness, third-party risk management questionnaires, and asking for vendor policies, certifications, and assurance reports.

• Seek Legal Advice Before Signing Contracts: While some SaaS contracts, especially for big players, are standard—take it or leave it—many vendors are open to reaching an agreement that satisfies both parties. Use expert advice to ensure that relevant clauses protect your company. Areas of interest could include confidentiality, SLAs, shared responsibilities, privacy, scalability, integration, AI usage, etc.

• Monitor Performance: Dedicate some time on a monthly, quarterly, or yearly basis to assessing whether the service continues to meet your needs in terms of quality, compliance, and security. Did the other party respond in due time to incidents? Were they breached? Are they still certified? Did they outsource any parts of the service? Don’t lose visibility once your contract is signed.

• Avoid Vendor Lock-In: While big players are not easily replaceable, it’s a good idea to have an inventory of your third parties and their potential alternatives in case a change is needed. Events that can lead to such a change include poor quality of service, price spikes, unfavorable changes in terms of services, the vendor experiencing a data breach, or the vendor going out of business.

Choose the Right Auditor

After your first layer of controls is implemented, it’s time to conduct an external assessment. Even if you haven’t ascertained just yet which certification best suits you, it’s a good idea to seek an independent auditor who can examine your control environment and advise on further steps in compliance. This step is crucial to get you on the right path to your future certifications. 

Three pieces of advice here:

• Look for a Trusted Partner: Even if you choose a small company or an independent auditor, conduct your due diligence, just as you would for a third-party solution. Ensure that the auditor is authorized, experienced, and familiar with your industry. An NDA, in addition to the contract, may also be appropriate.

• Be Honest: This relationship should benefit you in your compliance journey. Offer transparency on the efforts conducted so far in terms of risks and controls, express your concerns about any potential gaps, and ask as many questions as you need. For instance, if you have more detective than preventive controls for data leakage, the auditor should advise whether this is sufficient or may pose some regulatory and compliance risks that you cannot accept.

• Follow up on the Observations: Too many times, once a non-regulatory audit is over, the focus shifts to other tasks. However, it’s best to take the audit insights back to your management and teams, determine the required work for improvement, and track it until completion. The change may be an improved workflow, better governance, creating a missing process, or purchasing a new tool to fix insufficient security coverage. You may choose a follow-up audit with the same auditor before proceeding to a certificate-based audit.

Obtain Your First Compliance Certification

Depending on your goals, capabilities, and readiness, you may choose to pursue any of the common certifications or attestations below. If you feel that you have a strong control design (documentation) but are still working a lot on operational effectiveness, you may choose to start with ISO 27001 and SOC 2 Type I. If you’re a SaaS company that provides services involving cardholder data or if you are an online retailer, you should get PCI DSS compliant as soon as possible.

Some audits have several audit phases and maintenance cycles. Here’s a summary of the most common ones.

Grow Your In-House Control Functions

Large enterprises have control functions (compliance, legal, DPO, information security, and others) consisting of hundreds of people. For a startup, an in-house compliance function may be last on the list, but as your business grows and you advance in this realm, external consultants may become quite expensive.

In addition, internal knowledge and oversight of your security and compliance posture pay off as more and more customers are onboarded and you need to comply with hundreds of requirements. Several customers may ask you, during their own due diligence: “Do you have an in-house information security officer?” Their purpose is to know that you are serious about compliance and take accountability; your purpose is to build trust with them and, where needed, with regulators.

Even if you can appoint one person to wear a multi-hat (compliance/risk/security), this central point can be more valuable for your startup and its stakeholders than managing dispersed information and ever-changing consultants.

Invest in a GRC Tool

Obtaining your first certification is a major milestone that separates you from startups that are not quite there yet. Remember, though, that compliance is a continuous effort. New frameworks pop up, your controls change, you keep onboarding vendors, you reassess your risks, you have new audit findings, and everything needs to stay documented. As such, it’s best to look for a GRC tool suitable for your business where you can centralize all this information, automate it, and pull it quickly whenever needed.

Here are some of the must-have features of a GRC tool:

• Security Tool Integration: Seamless integration with other security tools to provide a holistic view of the security posture

• Common Control Frameworks: Support for frameworks like NIST 800-53, ISO 27001, and COBIT to align risk management with industry standards

• Customized Controls: The ability to use tailored controls to meet specific organizational needs

• Risk Planning: Facilitating and managing the creation and execution of risk mitigation plans

• Historical Trend Analysis: Identifying emerging risks and tracking mitigation efforts over time

• Active Monitoring: Real-time monitoring to detect increased risk exposure

• Artifact/Evidence Repository: A secure, centralized repository for compliance evidence

• Robust Reporting: Generating customizable reports for stakeholders to demonstrate compliance and provide visibility

• Compliance as Code: Continuously monitoring and testing across the entire software development lifecycle