Startup Compliance Atlas

Learn the basics, then choose your compliance path.

You do not need to know the audit vocabulary to begin. Work through these four steps, then follow the route your business needs. SOC 2 is one route. Your startup may also have other requirements to address.

1. Step 01

   Understand what compliance means

   A customer asks who can access its data and wants records supporting your answer. That request gives your team a concrete job: understand the requirement, check what happens today, and show the result. Compliance is the work of meeting the requirements that apply to your business.

   A prospective customer sends a security questionnaire. Before buying software or booking an audit, ask what decision they need to make and what evidence they will accept. A completed questionnaire, a security test, and an independent audit report answer different questions.

   Try this with your team: Write down what prompted this work, who needs an answer, and when they need it.

   Next: work out what applies

2. Step 02

   Work out what applies to your startup

   Start with your product, customers, and data. Requirements can come from laws, signed agreements, or a customer's purchasing process. Keep those sources separate so you know which are obligations, which are requests you can discuss, and who can resolve an unclear answer.

   Describe the service in ordinary language: what it does, whose information it uses, where that information goes, and which providers help you run it. Include support tools and staff access. This description becomes your scope: the part of the business your compliance work covers.

   Try this with your team: Make a list with the requirement, its source, the service it affects, the person checking it, and any deadline. Have a qualified adviser resolve questions about legal applicability.

   NIST's Small Business Quick-Start Guide (February 2024) recommends identifying legal, regulatory, and contractual cybersecurity requirements and assigning responsibility. It is voluntary guidance for organizing security work.

   Next: turn requirements into work

3. Step 03

   Turn requirements into work people can do

   A requirement tells you what needs to be true. A policy states your company's rule. A control is the check or procedure that puts the rule into practice. Give each control an owner who can explain how it works and who takes over when they are away.

   Suppose your policy says departing employees lose access. The control is the process that tells someone about the departure, removes access from the relevant systems, and checks the result. Writing the policy does not remove an account.

   Try this with your team: Choose one requirement and write the actual steps, the owner, when the work happens, and how you will check the result. Compare those steps with what your team does today.

   Next: understand evidence and review

4. Step 04

   Keep records that show what happened

   Evidence is the record supporting an answer. In the employee example, that could include the departure request, dated access-removal records, and the check that access was removed. Save records as the work happens so you can explain the result later.

   A compliance platform can organize tasks and collect records, but someone still needs to check whether they answer the question. Readiness means preparing the work for review. If your chosen route includes an independent assessment, the auditor or assessor evaluates it under the agreed scope. Other obligations require ongoing work without an audit report at the end.

   Try this with your team: Pick a completed task. Ask someone who did not do it to explain what happened using only the saved records. Note what is missing or unclear.

   Our article on reviewing compliance evidence explains why collecting a record and judging what it proves are separate jobs.

   Next: choose the route you need

Take the path that fits your requirements.

Start with the requirements you identified above. These routes serve different purposes, and you may need more than one. A SOC 2 report does not settle every legal or contractual question for your business.

• RouteStep 1Step 2Step 3Step 4
• SOC 2 Type 1
  1. 01Confirm the request
  2. 02Put the checks in place
  3. 03Review the package
  4. 04Complete independent review
• SOC 2 Type 2
  1. 01Agree on scope and period
  2. 02Assign the work
  3. 03Save records as you go
  4. 04Work with the auditor
• ISO 27001You need to build a security management program and may want it independently certified.
  1. 01Define the management system
  2. 02Assess and treat risks
  3. 03Operate and review
  4. 04Prepare for certification
• HIPAAYour business handles health information and needs to establish its HIPAA responsibilities.
  1. 01Find where health information goes
  2. 02Analyze risks
  3. 03Put protections in place
  4. 04Evaluate changes
• PCI DSSYour business accepts card payments or provides a service that may affect their security.
  1. 01Map how customers pay
  2. 02Confirm the assessment you need
  3. 03Implement and test
  4. 04Submit and maintain
• GDPRYour business uses personal data and needs to establish which GDPR responsibilities apply.
  1. 01List the data you use
  2. 02Document the decisions
  3. 03Make procedures work
  4. 04Review new uses