[tptacek]

Literally any firm can get a SOC2 Type 1, because there's no lookback to it; the Type 1 is a pinky swear.

In practice, if you're careful about how you do your Type 1, the Type 2 is almost as trivial. Your HR/bizops practice is much more likely to screw up and cause exceptions than anything you do in IT or engineering.

[xocnad]

From my 8 years of working SOC2 Type 2 audits done by PwC for a large PaaS Cloud with a worldwide presence (not the big 3) saying Type 2 is almost as trivial as type 1 is absolutely false. This might be true for someone running their own low volume SaaS in one region but for someone the size of Apple they are investing a lot of resource to stay on top of the controls, especially patching and permissions. If you've invested heavily in homogenization and automation your less likely to fail and the audits will be simpler. Even with significant investment I expect there are many aging corners in any "cloud" that make audits subject to failure and require a lot of work to avoid qualifying exceptions.

[tptacek]

I'm not going to, like, whip out my resume here, but I am going to confidently assert that if you structure your Type 1 carefully, you can trivialize your Type 2, and as someone currently operating a globally deployed public cloud I can tell you right now that SOC2 doesn't really touch on anything interesting in our engineering.

I wrote an article about this, and I think it's the Correct advice for virtually every startup thinking about SOC2:

https://fly.io/blog/soc2-the-screenshots-will-continue-until...

A few years before that, I wrote an article about what we learned from the consulting practice we ran building SOC2-supporting security programs for startups:

https://www.latacora.com/blog/2020/03/12/soc2-starting-seven...

I've had the experience, many times, of offering this advice in some forum and having someone try to rebut it, claiming that SOC2 is difficult, or that real customers will pick a SOC2 attestation apart with a fine-toothed comb looking for shortcuts you took, or that they built their whole security practice around SOC2. I can go all 12 rounds with someone on any of those points, but I think you can get most of my take from those two posts.

[xocnad]

It doesn't look like fly.io publicly disclose who there auditor is so it is hard to judge that specific part of your experience. I'm not disagreeing with your perspective on startups. I'm saying that type 2 gets much harder when you are large. non-homogenous and lack sufficient automation and monitoring.

[tptacek]

Our auditor is Aprio.

[Terretta]

For anyone reading along, both of tptacek's comments are saying the same thing I'm saying. Or I'm saying the same thing he's saying.

Either way, go read his links.