[sb8244]

For sure. Big challenge with those companies—that I found—is that they want a lot of credentials + proof that are simply outside of the reach of small businesses. So even if you're full-time, it may be a "good luck" scenario.

Although SOC2 is fairly easy to get, it's expensive for bootstrapped founders (maybe $30-45k all in.)

It wasn't enterprise, but the 600 person company (that I knew very well) simply wouldn't work with us in the end because we were too small (2 of us.) It sucked, a lot, because the deal cycle took about 18 months to get to a firm no. Since then, everyone involved has left the company

[gunapologist99]

SOC2 (Type 1) doesn't have to be that expensive, not counting your own time. For a very small company, it can run as low as $12-15k. Shop around.

Don't invest a lot of time in individual deals when you're small. Aside from the time and probably attorney fees (and opportunity cost), it's pretty demoralizing if it doesn't come through, and most of the time it doesn't, especially when you're small. The distraction alone can kill your company.

Focus on many smaller deals rather than one or two big deals.

[sb8244]

Agree completely. Going after small deals ruthlessly would've been my biggest change. We were trying to, but so much was wrong with the actual way we were trying to sell.

Btw the price comes from my latest adventure. I think 12k is too low unless you can literally do everything without help (i could have but it would've destroyed my time.) 20k is probably a realistic price floor with pentest included.

Although type 1 doesn't require a pen test or you to actually do anything. Just to say you would do it a certain way. Every prospect that has asked for SOC2 has wanted a separate pentest deliverable.