Skip to content

Our Compliance Journey

Unveiling Our Compliance Journey: Why, How, and Who!

October 10th, 2023

Hey there, awesome readers! After sharing Signority’s SOC compliance triumph, my inbox has been lighting up. Many of you have expressed a keen interest in our experience, specifically the ins and outs of selecting service providers and navigating the audit process. So today, I’m going to unveil the behind-the-scenes of our compliance voyage. Whether you’re a compliance guru or just embarking on this journey, I hope our tale illuminates your path. Let’s dive into the details!

The Old Days of Compliance

Let’s take a quick trip down memory lane. There was a time when achieving compliance felt like climbing Mount Everest. A hefty price tag, years of effort, setting up an entire compliance team, endlessly training them, tweaking product development plans – phew! This is a rich man’s large enterprise world, and dare for SMBs to think about it. Thanks for innovations in the compliance industry disrupted the Big 4. 

Rewind to a time when achieving compliance was like scaling Mount Everest: costly, complex, and primarily a game for the corporate giants. The domain, once tightly held by the Big 4 – Deloitte, EY, PwC, and KPMG, has been reshaped. Thanks to innovative disruptions, what was once a luxury has become accessible. Today, even SMBs can navigate the compliance journey without breaking the bank. As an entrepreneur, it’s heartening to see intricate processes simplified for all. Now, our toolbox for compliance comprises essential elements: a platform, auditors, and Penetration Testing.

Navigating the Compliance Maze

Navigating the intricate waters of compliance can be daunting. But, with a bit of guidance and the right tools, it becomes a manageable voyage.

First, let’s clear the air on two terms that often cross paths: ‘compliance audit’ and ‘attestation’. In simple terms, think of a compliance audit as checking whether you’re following universally accepted standards like SOC, ISO, etc. On the other hand, attestation is getting a nod from a third party that you’re in line with specific legal acts and regulations. Just to drive the point home: while standards are crucial, adhering to regulations isn’t optional. In the Canadian landscape, for instance, laws like PIPEDA and PHIPA aren’t just guidelines—they’re mandates. Not every auditor will cover both these areas, which is why our partnership with Prescient, who excels in Canadian regulations, was pivotal.

Now, let’s talk SOC 2. It houses five principles. The big question is, do you need to embrace all of them right from the outset? At Signority, we had been embedding SOC 2 and ISO compliance practices into our DNA for a couple of years before we initiated the official audit. This proactive approach significantly streamlined our journey.

Also, it’s crucial to recognize overlaps between standards. For instance, the resemblance between SOC 2 and CSA Cloud Security or ISO 270017 and ISO 270018 isn’t purely coincidental. Determining which one to focus on first can require a bit of introspection. Consider your budgetary constraints, your customer needs, and the industry you’re in. Mapping out a strategy based on these factors can set you on the right track.

The Essentials of Vendor Selection

Navigating compliance isn’t a one-time affair; it’s a continuous journey with checkpoints at least every 12 months. Given the intricate setup and the time it demands, it’s crucial to adopt a long-term perspective.

In this voyage, three key tools will guide you: a compliance platform, an auditor, and a penetration test service. Before committing to a compliance platform, it’s a wise move to request a product demo. This helps gauge the user-friendliness and the array of features on offer, ensuring you’re making an informed decision. Although these tools often come from different vendors, their coordinated effort is the key to seamless integration. Opting for vendors known for their harmonious collaboration is essential. For instance, we trusted Secureframe‘s recommendation and chose Prescient Assurance as our auditor – a decision we don’t regret. The added benefit? Prescient’s Pen Test services, further smoothing out our journey’s path.

Grasping the methodology and key milestones of your service provider is essential for a triumphant audit journey. Jumping headfirst without ample preparation can land you amidst myriad vulnerabilities and challenges. Most providers initiate with a pre-scan or preliminary audit, offering you a window to address their suggestions before the final review. To ensure a successful outcome, it’s wise to conduct internal audits first and then invite your service providers for a pre-scan. During the vendor selection phase, insist on a roadmap of deliverables. Especially if you’re new to this terrain, seasoned service providers should be eager to provide insights and advice for effective project management.

Also, it’s a good practice to inquire about the team that will be assigned to your project and understand their qualifications. Communication is crucial. For instance, Secureframe and Prescient facilitated our communication via dedicated Slack channels, enhancing our engagement beyond just emails and calls. This immediacy was invaluable, especially when unforeseen challenges arose. Case in point: We’d planned our 2023 audit with Prescient for August. Yet, when an RFP required us to submit our report in June, Prescient, despite their pre-existing commitments, went the extra mile to accommodate our needs.

The expansiveness of policy libraries is crucial. Having a platform stocked with a plethora of best-practice policies is a game-changer. It saves immense time and effort, eliminating the need to start from square one.

The ability to integrate with your existing infrastructure for compliance auditing is critical. It not only saves time but also allows for instantaneous snapshots, bolstering the credibility of the audit.

On a related note, Secureframe recently rolled out an AI-powered feature designed to assist customers in responding to RFP security queries. Given that security responses can make up to 40% of an RFP, this feature is a significant boon for companies actively participating in RFP bids. 

Before sealing the deal, always seek out 2-3 references. We gleaned surprising insights from our reference checks. It’s heartening to see how eager people are to share their experiences and lessons, helping you sidestep potential pitfalls.

I attached our vendor selection and reference check questionnaires at the end of this blog.

Penetration test

The penetration test, commonly known as “Pen test,” has a notable influence on the product. 

In preparation, Prescient supplied us with their testing methodologies and toolsets. Their input was invaluable; While we had initially set sights on a Level 1 test, after reviewing one of our enterprise security requirements, they recommended advancing to a Level 2 test. Impressively, they also offered us the flexibility to adjust our initial quote.

Staying Updated

The world of compliance isn’t static. With new regulations popping up, like Quebec’s Bill 64 privacy act, staying updated is crucial. Ensure your vendors are clued into these changes, and have a plan to support your evolving needs.

Our Wishlist for the Future

Before we wrap up, we wanted to share a couple of ideas that might further streamline the compliance journey. By no means are these criticisms; they’re simply our musings on what could make the process even smoother in the future:

  • AI-Driven Policy Integration: Imagine a world where there’s an AI tool that seamlessly integrates a platform’s policy libraries with individual company policies. This would effortlessly yield a tailor-made, optimized policy, harnessing the best of both worlds.

  • Diverse Payment Options: As compliance becomes increasingly accessible to companies of all sizes, it might be beneficial for vendors to explore diverse payment currencies. For Canadian enterprises like ours, having an option to pay in CAD could be a small yet impactful convenience.

In conclusion, we are genuinely grateful for our partnership with Prescient Assurance and Secureframe. This blog aims to share our journey, hoping to be a beacon for other businesses and express our sincere appreciation to our partners who’ve stood by us every step of the way. We’re excited about the future and can’t wait to see how the world of compliance evolves!

Staying Updated

The world of compliance isn’t static. With new regulations popping up, like Quebec’s Bill 64 privacy act, staying updated is crucial. Ensure your vendors are clued into these changes, and have a plan to support your evolving needs.

Leading eSignature and Document Workflow Platform in the FileCloud Portfolio
SIGNORITY AQUIRED BY FILECLOUD! Leading eSignature and Document Workflow Platform in the FileCloud Portfolio