Security compliance

Security compliance means meeting a published set of security rules and being able to prove it. A company says "we protect your data"; compliance is the paperwork and the outside check that back that sentence up. Big customers, especially banks, hospitals and governments, often refuse to buy software from a vendor that cannot show it.

Two frameworks come up constantly. SOC 2 is an American standard from the AICPA, the US accountants' association: an independent auditor examines a company's controls (who has access to what, how changes are reviewed, how backups and incidents are handled) and writes a report. A Type I report looks at a single day; a Type II report checks that the controls actually worked over several months. ISO 27001 is the international standard: a company builds a management system for information security, and an accredited body certifies it, with yearly follow-up audits. Others apply to specific data, like PCI DSS for card payments or HIPAA for US health records.

Compliance is not the same as being secure. It shows that sensible processes exist and are followed, which forces a company to do a lot of good things: inventory its systems, review access, train staff, log and test. But a company can pass an audit and still be breached. Startups usually meet this when their first large customer sends a security questionnaire, and these days whole tools and services exist to help them collect the evidence.