AWS' SOC 2 isn't also yours
A few times a week, we get "not interested" email replies from smaller prospects who tell us that they don't need a SOC 2 because "it's covered" by one of their vendors.
The most common vendors that folks like to call out are AWS and Google Cloud.
It's great (and true) that those companies have their own SOC 2 reports, but just because they've put in the work doesn't mean that you're in the clear.
There are "carve-outs" tied to using managed vendors (meaning you will have fewer SOC 2 controls), but those represent a small percentage of the work that's involved.
For example, you might have 100 controls in your entire SOC 2 report, and the following might be the only ones that you can "carve-out" because you rely on AWS:
As an early-stage company trying to tap dance around SOC 2 requirements, I encourage you to try using the "we use managed vendors" line - but be wary of prospects who accept it.
Growing the partnership economy through customer advocacy
5 年Eric well said. We see competitors try to use this all the time. Thankfully the Enterprise security teams see right through it. However, there are a lot of smaller companies that don’t know better.