[geocar]

> Here is an experiment - tell your employer you will be hosting on (insert no-name provider here), to same a literal million dollars, and see if you can get security team to sign off on it.

SOCS/PCI/etc is going to take maybe $100-200k. If you can save a million dollars you should do it. Hire an expert if you have to. Serious.

I think it probably won't save you a million dollars, because I think all of the cloud vendors are priced with just enough profit to make sure of it, but if you know something I'd like to know about it.

[JustLurking2022]

Speaking as someone who went through this process at a large financial firm, you're off by at least an order of magnitude. You need a SOC1 audit of each product you plan to use, which is likely quite a few if you want to take full advantage. The big players should eventually be able to offer that for free once they've been through the process but, at least relatively recently, it was only true today if your cloud budget was tend of millions. That aside, you'll still need an audit of your usage of the cloud (i.e. how you deploy to it and handle movement of data back and forth). That'll always be on your dime.

[geocar]

No. At the end of the day, the customer pays, because I charge more for bullshit. They need an SOC to use my cloud product it cost me 150k USD to get an audit from a big-four for a single site in 2016. Maybe it’s a little more today, but it’s not an order-of-magnitude.

I’m assuming you already adhere to the relevant standards. Obviously if you’re cutting corners getting up to snuff is going to cost a lot more than a hundy.

[JustLurking2022]

A Big 4 can't conduct a proper SOC audit without access to the cloud providers internal controls/processes. That's the problematic/expensive part since it requires a bunch of time from the cloud provider, which they will also likely want to bill for.

[galleywest200]

As someone currently dealing with SOC in preparation for the company I work for going public, I will also confirm it is a giant bean-counting pain in the butt.

[Moissanite]

> I think all of the cloud vendors are priced with just enough profit to make sure of it

Profit margins on cloud computing are insanely high (at least, relative to my expectations). They basically have no interest in anything with less than a 15% margin, even at the massive scale they operate at. Certain products have triple-digit margins. Even if they are the minority, I don't think we can give them a pass with claims of "just enough profit".