Straight answers to compliance questions

Do I need SOC 2 to sell to enterprise customers?

For most B2B deals over $100k ACV, yes — SOC 2 is a hard revenue gate. Below $100k, security questionnaires often work as a substitute. Above $250k, Type 2 (not Type 1) is usually required. Start Type 1 the moment enterprise deals enter your pipeline.

How long does SOC 2 take for a startup?

Type 1: 8–12 weeks for a prepared 20-person SaaS team with modern cloud infra. Type 2: add a 3–12 month observation window on top. Most startups target Type 1 first to unblock deals, then roll straight into Type 2.

What happens if I fail a SOC 2 audit?

You don't 'fail' SOC 2 like a certification exam. Auditors issue one of four opinions: unqualified (pass), qualified (some exceptions), adverse (systemic failure), or disclaimer (couldn't complete). A qualified report can still support enterprise deals if the exceptions are narrow and remediated.

How often do you recertify SOC 2?

SOC 2 is not a one-time certification — it's an annual attestation. Type 2 reports typically cover a rolling 12-month window and are re-issued each year. Most enterprise buyers require your report be dated within the last 12 months to remain valid for procurement.

What triggers a HIPAA audit?

OCR audits are not random. The four main triggers are: (1) a patient or employee complaint, (2) a breach report of 500+ affected individuals, (3) media coverage of a suspected violation, and (4) referral from another federal agency. Most audits stem from complaints.

Is CMMC required for prime contractors and their subcontractors?

Yes. CMMC 2.0 flows down from prime contractors to every subcontractor that touches Federal Contract Information (FCI, Level 1) or Controlled Unclassified Information (CUI, Level 2). If your contract references DFARS 252.204-7012, you almost certainly need CMMC.

Do I need a vCISO for CMMC?

CMMC does not require a vCISO. But for Level 2 assessments, most SMBs without a full-time security lead benefit from a fractional CISO for 4–6 months during prep — especially through the POA&M and evidence phases. Beyond that, tooling replaces most of the ongoing work.

What is a POA&M in CMMC?

A POA&M (Plan of Action & Milestones) is a formal document capturing control gaps and the plan to close them. Under CMMC 2.0, POA&Ms are permitted at Level 2 assessment — but only for a limited set of controls, and every POA&M item must close within 180 days of assessment.

ISO 27001 vs SOC 2 — which does a SaaS need?

Rule of thumb: US-heavy customer base → SOC 2 first. European or global buyers → ISO 27001. Selling to both markets? Run them in parallel — about 80% of the underlying controls overlap, so you can capture both certifications for roughly 30% more effort than either alone.

Is Vanta worth it for a 10-person startup?

For a 10-person startup pursuing one framework (usually SOC 2), Vanta is often 3–5x more expensive than SMB-priced alternatives while automating 80% of the same evidence. Vanta earns its price at 50+ employees and multiple frameworks. Below that, cheaper tooling usually wins on TCO.