[magicalhippo]

> If you don’t do this, be prepared for a mini-audit on every sale (if you get that far).

That's the position we're in, though as an older but still growing B2B we have to do this for existing customers as well.

We're in the process of getting ISO27001, meanwhile we got one guy out of 40ish almost full-time answering such questions now.

[louthy]

It never stops, but at least with evidence of audits, evidence of pen tests, and policy documentation, it can be a little easier!