The situation: An established SaaS startup with <100 employees, a large development team and several self taught networks engineers. Our business involves handling both PII and payment data.

As we've grown and given the increasing focus on infosec we've been receiving more customer demands for ISO and NIST compliance, SOC 2 reports and the looming threat of PCI.

At this point our infrastructure is reasonably secure but policies and procedures are very green and most put in place adhoc to satisfy a customer demand.

My question is: How should a company approach developing a more mature security compliance program and what costs are reasonable for a business this size to spend?

Most consultants recommend starting with a security risk assessment, then gap analysis then consultation as needed to develop policy until compliant.

Lawyers recommend working directly with a firm for everything. At this size should a company begin to think about hiring a dedicated security compliance specialist at upwards of $120k per year? Or is it just a matter of telling the network engineers to drop their projects and start boning up on ISO and NIST for the next several months?

TLDR: What is a sensible approach to start building a mature security compliance program for a small to mid sized company? Are consultants a must or does it just require elbow grease? Where does money need to be spent, where is it a good idea to spend and what is a waste?

  • Your cost question is unanswerable
    – schroeder
    Commented Jan 22, 2018 at 11:06
  • Whether you should hire someone to do it or train your people to do it is not a security question at all but an "opportunity cost" question: can your people accomplish the task in time and with enough quality while not delivering the value they could have been delivering? That's an HR issue. We cannot tell you what to do on that one.
    – schroeder
    Commented Jan 22, 2018 at 11:09

2 Answers 2


First, if you are not PCI-DSS compliant and you are processing payment information, drop everything and address this first. If you address this in a robust way, then you can leverage the compliance activities to build a larger information security infrastructure for your organisation. This is your first gap!

I have been where you are.

Although a Risk Assessment is normally where organisations should start (and you should do one!), my guess is that it will only be a distraction for you at your stage of development. You have a more immediate task at hand.

You should not be seeing PCI-DSS as a threat but an opportunity to embrace. You need to embrace PCI-DSS and (SOC 2) as a tool to define what you should be doing and the infrastructure you need to be compliant. Do not "skimp" on this step, but take it on as a regulatory requirement to meet head-on and to fully satisfy.

This activity exists apart from risk as something that "just needs to get done". Focusing on this at the start removes the debates and the political tensions. Both PCI-DSS and SOC 2 require external auditors and expert guidance. Spend your time and money on these things, to start.

It would be even better (for secure processes and risk) if you used the ISO 27001 and/or NIST frameworks to design an approach first for which the PCI-DSS and SOC 2 can have a place, but this is simply not efficient for small companies, and not where the immediate value can be found. If you can do the first steps well and gain success and value, you will have an easier time getting the bigger stuff done.

I'm a fan of "Agile" security: get your entire needs mapped out as you understand them right now, but tackle the critical areas first (in the light of the coming needs). For you, you have technical security issues to address first (PCI-DSS). Design the approaches to address those needs in the light of a larger framework, but address those needs first! Then build iteratively from there.

  • If you are processing payment and you don't know if you're PCI-DSS compliant, then the easiest way to start being PCI-DSS compliant is to remove any payment processing and offload to external payment processors like Paypal so you don't need to bear the full brunt of PCI-DSS. Making the decision whether to switch to external payment processor, dropping all payments capability, or to preserve the status quo until you can do PCI will likely require some form of risk assessment though (even if it's just limited to PCI issues), so I disagree that PCI-DSS takes priority over risk assessment.
    – Lie Ryan
    Commented Jan 22, 2018 at 12:10
  • @LieRyan I hear you, but the OP states that handling this data is part of the business (we don't know to what degree or if they are processing payments or are a service provider). So, sure, doing a risk assessment to determine if they should handle it is one way to go, but to take the business as it is and to take steps forward, then PCI-DSS is a great foundation for a more robust security infrastructure (for the above reasons).
    – schroeder
    Commented Jan 22, 2018 at 12:52
  • Just a point of clarification: PCI does not require external auditors in all cases. The Self-Assessment Questionnaire is designed for just that - self assessment (see the Self Assessment Questionnaire Instructions and Guidelines, pcisecuritystandards.org/documents/SAQ-InstrGuidelines-v3_2.pdf). Page 3 states, "The PCI DSS SAQ is a validation tool for merchants and service providers not required by their respective acquirers or payment brand(s) to submit a PCI DSS Report on Compliance (ROC)." Always consult with the acquiring bank to determine the correct assessment level.
    – waltonob
    Commented Jan 22, 2018 at 18:03

Risk assessment is a must. The decision on how much you want to spend on the process will be partly based on the result of the risk analysis, so it is a baseline that you will need to do.

Whether you should work with external consultants depends mostly on whether your customers and regulators demand that you do a formal audit with a compliance certificate from a qualified assessor, or whether they can accept an informal audit that are loosely based on those audit standards. If your customers/regulators demand a formal certificate, then you don't have much choice but to work with an external consultant.

Other than that, it's just a matter of whether you have any employee that's willing to study the relevant audit documents and whether you're in a hurry to get audit done. Remember you need to allocate extra time for the employee to study the audit standards while a qualified assessor would already be familiar with it. This training time should be included in your cost calculations when deciding on whether to go with a consultant.

An audit, even with qualified consultant, can take months to complete. You need to make sure whoever you assign do the audit actually can be off their primary role for that length of time.

  • SOC 2 requires external auditors
    – schroeder
    Commented Jan 22, 2018 at 11:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .