Picture yourself at an AWS-using startup. It’s a year or two old and maybe starting to see product-market fit. As the CTO or one of the first engineers, you’ve made but a fraction of the architectural and technical decisions that will be made over the course of the

How to operate and improve your compliance program after a first SOC 2 audit If you’re reading this while your customers are reviewing that first SOC 2 report, then congratulations. You’re now getting maximum credit for good security practices!  Celebrate quickly, though, because the work continues. Especially if

What to know going into your first SOC 2 audit Once you’ve defined controls that meet the SOC 2 criteria, it’s time for your first SOC 2 audit. (See part two of this series if you still need to define your controls.) During your audit, you’ll prove

Reading the criteria, writing controls, and preparing for your first SOC 2 audit No matter how deftly a startup delays SOC 2 compliance (as discussed in part one of this series), they will eventually need to tackle it. When you’ve filled out enough infosec questionnaires to last a lifetime,

In You should have lots of AWS accounts, I made a case for isolating environments and even services in their own accounts to reap all sorts of security, reliability, and compliance benefits. With the right tools in hand (Substrate, for one), operating lots of accounts can be just as efficient

I know. You need another AWS best practice like you need another covid exposure. But you really should have lots of AWS accounts. Lots of AWS accounts working together in harmony will net you a more secure, more reliable, and more compliant cloud infrastructure. All of the reasons to have