SOC 2 Compliance

[ArendPeter]

Type 1

Less Controls, Less Requirements, Easier to Get

Time estimate 1-2 months

Type 2

Takes Longer To Get, Expensive, More Controls

Costed $20-40k

• $12k for compliance software (ex. vanta)
• $15k for auditors

Time estimate 3-12 months

• 2 weeks non-tech
• 2 months tech
• Also requires a monitoring period (1.5 months)

Categories (many just choose to do security)

• Privacy
• Security
• Confidentiality
• Processing Integrity
• Availability

Other Notes

• Need to Hire a CPA

Refs

https://www.youtube.com/watch?v=qfqkEZUumcc
https://microconf.com/latest/soc-2-checklist
https://www.youtube.com/watch?v=syy-0-EF47o

Questions for client

• Which type of Soc 2 do they require (1 or 2)
• Which of the 5 categories need to be covered: Privacy, Security, Confidentiality, Processing Integrity, Availability

[github-actions]

👋 Hi @ArendPeter! Thank you for taking on this issue!

To help us track progress and support you effectively, please provide the following information:

Availability for this week:

My estimated ETA for completing this issue:

Feel free to ask questions in the #bettervoting Slack channel if you need any help!

[ArendPeter]

I put this in outside roadmap, since it'll will clearly be a large financial and time investment. Even after implementing there's a multi-month period for audits

[ArendPeter]

NOTE: also consider HIPAA compliance at the same time