{"id":966,"date":"2021-09-15T15:37:00","date_gmt":"2021-09-15T15:37:00","guid":{"rendered":"http:\/\/box5442.temp.domains\/~arpioio\/?p=966"},"modified":"2022-08-05T20:55:10","modified_gmt":"2022-08-05T20:55:10","slug":"soc-2-compliance-can-it-be-done-in-6-weeks","status":"publish","type":"post","link":"https:\/\/arpio.io\/staging\/8013\/soc-2-compliance-can-it-be-done-in-6-weeks\/","title":{"rendered":"SOC 2 Compliance &#8211; Can it be done in 6 weeks? [webinar]"},"content":{"rendered":"<body>\r\n<p><script src=\"https:\/\/fast.wistia.com\/embed\/medias\/x9tmqm3wtj.jsonp\" async=\"\"><\/script><script src=\"https:\/\/fast.wistia.com\/assets\/external\/E-v1.js\" async=\"\"><\/script><\/p>\r\n<div class=\"wistia_responsive_padding\" style=\"padding: 56.25% 0 0 0; position: relative;\">\r\n<div class=\"wistia_responsive_wrapper\" style=\"height: 100%; left: 0; position: absolute; top: 0; width: 100%;\"><span class=\"wistia_embed wistia_async_x9tmqm3wtj popover=true popoverAnimateThumbnail=true videoFoam=true\" style=\"display: inline-block; height: 100%; position: relative; width: 100%;\">\u00a0<\/span><\/div>\r\n<\/div>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Thanks for joining us today, everyone. We\u2019re excited to tell you about some SOC 2 stuff. This webinar is going to be my journey, Arpio\u2019s journey, pursuing SOC 2 in collaboration with Laika. I think we\u2019re taking a pretty conversational approach. I want to encourage you guys to go ahead and ask questions as you have them and shoot them in the chat. We can answer those in real-time.<\/p>\r\n\r\n\r\n\r\n<p>Meanwhile, Sim, who I\u2019ll introduce in just a second, or she\u2019ll introduce herself, she and I will tell you what it has been like thus far and where we are on the SOC 2 process. Just to dive in, let me tell you guys, I\u2019ve met some of you in person before, some of you have not, but my name is Doug. I\u2019m one of the founders of a company called Arpio. We\u2019ll talk about what Arpio does in a bit, but we\u2019re a SAS business, and we are in the process of doing SOC 2, which is what we\u2019re going to talk about here.<\/p>\r\n\r\n\r\n\r\n<p>I come to this from the perspective of an engineer. I\u2019ve been a cloud engineer for a little more than a decade, managing software teams, and Arpio is the first time I\u2019ve started a company and the first time I\u2019ve had to do SOC 2 directly, although companies I\u2019ve been at before have done the process before. And that\u2019s a bit of me. We can dive in more on that later, but Sim, who are you?<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat<\/strong> <strong>Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Hi, I have been working at Laika for the past few months. I have four years of experience from KPMG doing security, risk, and compliance. I\u2019ve been here really helping you guide you through your compliance program, which helped build Arpio\u2019s SOC 2 compliance program.<\/p>\r\n\r\n\r\n\r\n<iframe loading=\"lazy\" src=\"https:\/\/docs.google.com\/presentation\/d\/e\/2PACX-1vRbo1blSjNkzMUj3OhuJhwal92hrMhYHW85_ZzIkGrcXhXbOkPssewe_21igHtk0BQXA0OR_8lGBHMc\/embed?start=false&amp;loop=false&amp;delayms=10000\" frameborder=\"0\" width=\"960\" height=\"569\" allowfullscreen=\"true\" mozallowfullscreen=\"true\" webkitallowfullscreen=\"true\"><\/iframe>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Yeah. You\u2019re our compliance architects then, right? Is that the official term?<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Compliance architect? So I just guide you by making sure that your policies are making sense, that you\u2019re implementing the right controls, your best practices, and building up that foster so that your customers can trust you and that you are SOC 2 compliant.\u00a0<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Fantastic. Awesome. Well, let me just dive in to get started. I think it\u2019s kind of relevant for everybody who\u2019s in attendance, just to explain why we chose to do SOC 2 at Arpio. And, I\u2019ll be honest, our business is still relatively young, but we\u2019ve been in the market for a couple of years, but something happened for us about three or four months ago, where conversations that used to say, do you happen to have a certification like SOC 2 suddenly became we won\u2019t work with you until you do have that in place.\u00a0<\/p>\r\n\r\n\r\n\r\n<p>Honestly, I don\u2019t know if that\u2019s a change that\u2019s happening in the market if people see that comprehensively if it\u2019s a reflection of where we are as a business, and we just happened to be working with organizations that are more formal in what their expectations are of their vendors, but it really, it makes sense.<\/p>\r\n\r\n\r\n\r\n<p>So, Arpio is a solution for disaster recovery of Amazon Web Services (AWS) environments. Our customers use us oftentimes because they\u2019re trying to be compliant with their own regimes that are appropriate for their business, but it\u2019s not fair for us to not also step up to that same compliance bar as they\u2019re doing. If we\u2019re going to help our customers be highly available and resilient to catastrophic events that happen in the cloud, we also need to be highly available and very much resilient to those same things. For us, Sim, it was really a customer-driven thing that\u2019s based on what our business does, I think, but also based on trends in the market.<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n\r\n<p>Yeah. I\u2019m really glad that you mentioned that. I imagine that the people on this chat also recognize that, and more as we head towards the future, customers realize how important their data is. They\u2019re going to ask the companies that are processing their data, are you doing the right things to protect it? Are you putting in the right security practices? At this point, data is knowledge, knowledge is power. I mean, data\u2019s becoming more important than money at this point. Customers have the right to ask the people who are really processing this to ensure they\u2019re doing their due diligence. I\u2019m really excited to see that you\u2019re really taking it on. You\u2019re excited about it. We\u2019re doing this webinar just to showcase the importance of this and why we really need to be excited about this. We want to serve our customers, and we want to serve our people, and we want to make sure that we\u2019re establishing that trust. So, yeah, I\u2019m glad that they\u2019re demanding this.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>It\u2019s funny. You used the word excited cause who really gets excited about compliance. But, I\u2019ll tell you, we\u2019re excited about this. This is a meaningful inflection point for our business. We\u2019ve been excited about working with you guys to do this. I think as we\u2019ll talk in a little bit, we thought compliance was going to be extremely difficult for us to attain, and it\u2019s been surprisingly doable as we go through this. We\u2019ll give a little more detail in a couple of slides. Tell us first about SOC 2 for people who don\u2019t know what this is all about. What is this all about?<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat<\/strong> <strong>Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>SOC 2 is a regulatory framework that was actually created by a group of accountants from the ICPA. It\u2019s really a framework that drives to show trust. Like I mentioned to your customers, you\u2019re doing the right things to protect their information from an internal and external standpoint. There are two types of tests that we do. There\u2019s a type 1 and a type 2. If you hit the next space bar again and one more time, great. There\u2019s a type 1 and a type 2. Type 1, tests a point in time. What\u2019ll happen is an auditor will come in and make sure that on Tuesday at 1:00 PM, your security controls and all your evidence is working as it should be at this moment. We\u2019ll do a point-in-time analysis. That\u2019ll be your type 1, your type 2 will test the effectiveness of your controls over a longer period of time.<\/p>\r\n\r\n\r\n\r\n<p>We know that security is not just a one-and-done thing. You can\u2019t just implement one control and then be done with it and walk away. You have to make sure you\u2019re monitoring it. You have to make sure that it\u2019s continuously happening. In a type 2 audit, we\u2019ll make sure that your controls are effective over that six to 12 month period. You\u2019ll want to make sure that you do your audits every year to make sure that you\u2019re up to date, and customers can really rely on the fact that you\u2019re continuously doing what you\u2019re supposed to do over that longer period of time. That\u2019s really overall what SOC 2 does.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Okay, so type 1, this is my layman\u2019s version of what you just said. Type 1 is, do you have the practices in your business that would allow you to be compliant type 2 is have you over a period of time been executing those practices faithfully so that you are truly compliant. I\u2019ll be honest, our customers are asking us about type 2. So, type 1 is what we are still in the late stages of achieving. Once we have type 1, that\u2019s just the beginning of this compliance journey for us. We have to exercise those practices, follow those policies and prove to the auditors six months out that we\u2019ve done that for the past six months so that they will grant us type 2. If I recall correctly, we have to get rerouted every 12 months.<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Every year.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Is this because it gives us a document that says, we\u2019ve certified that you\u2019re compliant, and this document expires in 12 months?<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Pretty much, but also, there\u2019s so much change that can happen within that year. You might hire new people, you might integrate your processes, you might do a new service opportunity. Every year as you grow, you want to make sure that as you scale, you\u2019re doing the right things as your business grows. That\u2019s also a big purpose of being able to monitor that audit every year.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Okay, great. Here\u2019s a question that we didn\u2019t prepare for, but I\u2019ve always wondered. I think of this as largely an IT framework, largely around security. Why is it invented by accountants?<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>By accountants? I want to say because accountants like audits is a very like black and white experience, you either are passing it or you\u2019re not. I think for that reason, SOC provides that really nice first step of a security program. Like ISO is not created by auditors. That\u2019s a very security focused technical focus framework. It\u2019s kind of a lot for just a regular business or small business to kind of tackle on the first thing. A SOC 2 kind of is a nicer, easier first step. That kind of makes it really clear that this is what you need to be doing, and this is what you should not be doing. That\u2019s my guess on maybe why it was created by accountants, but it\u2019s easy enough for people to digest, but it\u2019s not totally inclusive enough for it to truly be created by true security professionals.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Yeah. Sorry for the curveball there. I should\u2019ve warned you, I suppose, but anyway, all right. Coming into this, I had a preconceived notion, and this will probably shed light on that whole auditor thing or whatever. SOC 2 was going to be about security consultants charging us loads of money so that they can deep dive into our application, look at our architectures, read certain source code that felt like it was security-relevant, do all kinds of penetration testing to find the vulnerabilities that we need to fix, give us a lot of processes that were going to slow us down, and loads of documentation as part of that focused wholly on hacking and eliminating the chances that a bad actor can get into our environment and steal our data, do bad things to our service, and ultimately jeopardize our customer\u2019s data that we\u2019re the stewards of.<\/p>\r\n\r\n\r\n\r\n<p>So that was what I thought. I think ultimately what I\u2019ve found is that it\u2019s not security experts, it\u2019s compliance experts. This is where the accountant thing I think comes in is that it\u2019s people who understand both, some element of the security exposure, but also the legal perspectives on these problems, the risk perspectives on these problems, how it is that you put together a program that documents what you\u2019re going to do, and then how you support that with checks and balances in your business to make sure that you\u2019re following it appropriately.<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Definitely. That\u2019s a great take, actually.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>It is very much about the conversation. That\u2019s the conversation that we\u2019re having as an organization about what we want to be doing to be compliant, and making sure that we are aligning our operations with various best practices. Those best practices are things that we, I think we\u2019ve already known about. Most of the, for the most part, were already doing inconsistently within the organization, and what this has done is really pushed us to execute them more formally and more consistently through our operations.<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Like, organize your best practices.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Yeah. I mean, I think the last thing is we found it was not nearly as expensive as I thought it was going to be. I\u2019ve heard numbers from other companies about what they\u2019ve paid to get fully compliant. There are six figures involved in many of those numbers, and that\u2019s not been our experience. And we\u2019re a small organization. We don\u2019t have to deal with things like, how do you get a thousand people trained on security best practices, but for us, it\u2019s been. I think both because of the tooling that Laika has been able to provide for us and just the integration of all of the various services, or very little have we had to spend beyond what we\u2019re spending, with the Laika service.<\/p>\r\n\r\n\r\n\r\n<p>There\u2019s this concept in SOC 2 called trust services criteria. What are TSCs?<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>This kind of serves the foundation of your entire SOC 2 report. At a high level, there are five trust services criteria that your SOC 2 kind of encompasses or can encompass: security, confidentiality, availability, processing, integrity, privacy. So, a baseline at a minimum, you always need to have security criteria in place. We generally suggest we always start with security. It\u2019s a more holistic approach to integrating these controls. On the right-hand side, you\u2019ll see a list of areas that are common throughout the five trust services criteria. For you, we really scoped insecurity, confidentiality, and availability since you\u2019re heavily focused on business continuity and disaster recovery, and availability really plays a key component in that. How available is your data? Are you doing your data backups? Are you monitoring your data repository? How accessible is it that\u2019s such an impact on your business? And that was a reason why we scoped that trust service criteria for you guys.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Yeah, certainly. I mean, I think our customers are always concerned about the security profile of our workload. We connect to their AWS environments, and we orchestrate the DR process within that. We\u2019ve engineered the products to be extremely secure, but we have to be able to prove that to customers about how that works. So, the security TSC is just essential to support the statements that we make to our customers about that. To the point you\u2019re making, like, our product is all about availability when Amazon is not available. We\u2019ve engineered solutions to these problems, but how do we get a third party to come in and say, yep, they\u2019ve got five layers of defense against that. And layer one itself is rock solid. Layer two, three, four, and five, if they ever need them move there. But, hopefully, we never have to move to DefCon 2.\u00a0<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>No, but these are really great points. This is why we have a compliance part detect team at Laika because security is not a one-size-fits-all. If we were to just be a SAS product and give you kind of the solution, and we\u2019re like, Hey, implement it as you will. And you don\u2019t really get that guidance. You don\u2019t really get that conversation of, well, what if this happens? Or what if this happens? What if we layer this control? What if we change it up so that we\u2019re doing a different dimension of these controls? That\u2019s a huge part of the dialogue. That\u2019s a huge part of the conversation. As you grow and as you scale, it becomes a strategic conversation. That\u2019s something that we really value here at Laika as being part of that conversation throughout the process, so that as you grow or as you change, and you get these kinds of complicated questions where they\u2019re already to at least guide you through what we think would be the best solution there<strong>. <\/strong>But ultimately, the decision is always yours.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Yep. Yeah. I think it, yeah, ultimately it is always the business that decides what their requirements truly are. They have to be strong enough that the auditors will agree that they\u2019re sufficient. But, so much of this journey has just been about making sure that we are right-sizing for our organization, what we have to do here. As long as we\u2019re following those practices, the audit is going to be easy.<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Yes. No, very excited. Doug, tell me about your process, like your journey with Laika.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>First off, I did the math before the call here. We\u2019re, almost five weeks in, on our Laika journey. The question that we posed with the title of this webinar was, can it be done in six weeks? And we\u2019ll talk more about that later on. But, my recollection is that I went through a sales process. We had decided we were going to do this. We signed the contract with Laika, the next day we were getting the onboarding emails to go sign up. I think it was a weekend. We had an actual onboarding, deep-dive call. We spent a couple of hours with you walking through what our practices are. We demoed our application to you and showed you what it does so that you could put into context the kinds of controls that we need to support that. And I mean, we\u2019re up and running, it seems like within just a few days.\u00a0<\/p>\r\n\r\n\r\n\r\n<p>The tool then kind of takes over, and it gives us the workflow to go through. It starts with making sure that you\u2019ve got the right policy in place, and there are ten policies that we need in place. There are ten policies built into the tool that we don\u2019t have to go and figure out how to author one of these. We just need to take the policy that\u2019s there and figure out how to tailor it to what we need. As you do that, then there\u2019s a set of other tasks, and it just walks you through the process of making sure that you have established your compliance program and you\u2019re executing it appropriately. And that you\u2019re gathering evidence. Sometimes that evidence is gathered automatically. Sometimes you actually have to go and do manual stuff and put it into the tool.<\/p>\r\n\r\n\r\n\r\n<p>The whole idea is that the tool has organized the process and the information needed for us to pass the audit. I don\u2019t know, I look at like nine different bullets here, whatever we are, somewhere in the 5, 6, 7 range currently.<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Seven range. Yup. We\u2019re almost there. We\u2019re towards the end.\u00a0<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Once we get to eight, I think that\u2019s when we are type 1, SOC 2 Type 1, and then we get to do ongoing maintenance forever. I mean, it\u2019s like, we\u2019re signing up to do this forever.<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>I know. I know. We\u2019re going to kick off your risk assessment and do that because we need that for your SOC 2 as well. Just some we\u2019re going to help with this weekend and get there.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>So, for me coming into this, I did a bunch of research to understand SOC 2. I knew what type 1 was. I knew what type 2 was. I didn\u2019t know anything beyond that. That\u2019s really kind of been the education here. How is it that this is actually enacted? And I have a mental model. You\u2019ll have to tell me if it\u2019s wrong, but it\u2019s really, it starts with policies. We, as an organization, need to have documentation that says this is what we\u2019re going to do as an organization in these ten different areas. It\u2019s things like the information security policy, the compliance and risk management policy, how are we going to do change management and configuration management anywhere? We\u2019ve had processes around these things, but they were a little ad hoc, maybe not always written down, maybe never written down. And now we\u2019ve got them actually captured. Policies are a big part of the SOC 2 process, but the nice thing was we had 10 policies given to us, and we just had to go right-size them.\u00a0<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Another part of the policies, and I\u2019m really glad that you brought that up a big component of the audit. Isn\u2019t just the policies and making sure that the policies are in place, but it\u2019s managing the policy, that policy lifecycle, when you\u2019re making edits, are you documenting the history of the older policies? Do you have a sign-off process? Are you publishing those? And so that\u2019s also something that we kind of take care of in our, like a platform is being able to kind of manage that process. And it\u2019s such a tedious process. I don\u2019t think people really realized the idea of actually the policy life cycle management itself is such a big component of the audit experience. That\u2019s something you don\u2019t even have to touch, just given the platform. So, that\u2019s another thing I wanted to highlight with the offerings.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Yeah, no, I think it\u2019s going as honestly since you mentioned it\u2019s something that wasn\u2019t first-class knowledge in my head, but it is like we edit the policies in a Google doc style editor built into Laika, it\u2019s like a very rich experience. There\u2019s commenting and iteration, and there\u2019s a history of that stuff. When it\u2019s done, we hit publish, and it\u2019s live. That is just, certainly would be a real pain for us to manage those things directly in Google docs or something like that. So, we\u2019ve spent a good amount of time just making sure that we have the right policies in place for us. It comes down to this concept of controls. I\u2019m going to try to explain what I think policies and controls are. You\u2019re going to give me the compliance architect\u2019s authoritative statement of what it is, but the policy is our document.<\/p>\r\n\r\n\r\n\r\n<p>You kind of think of it as the management of our company saying, this is the way that we are going to handle these things related to security and privacy and business continuity, all that kind of stuff. The controls are actually the physical steps that we take or the automation software that\u2019s in place that will validate that we are following those policies. And sometimes those are proactive. Like you can\u2019t use the system if you don\u2019t have MFA turned on, sometimes it\u2019s more reactive. You need to go in and take a screenshot of something and load it into the tool so that you have evidence that you followed that. I think, to me, that the meat of the execution is all around the controls. The policies are there, but controls are where we spend our time, and we\u2019ll need to spend our time ongoing.<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Yeah. It\u2019s really interesting that you kind of bring this up. We\u2019re kind of a melding of the minds because we came in with all the policies, and you, someone who has a background in engineering, have very deep knowledge of the controls that need to be set into place. We\u2019re kind of just merging the two or we\u2019re seeing, how do we get alignment on what it is that the policies are really stating that you\u2019re doing and what it is that you\u2019re informally doing and how do we formalize it? So exactly what you said, the policies kind of formalized that control approach that you\u2019re taking. A lot of the conversation, a lot of the dialogue is adopting these policies so that they fit the controls that you\u2019re putting into place. That\u2019s where it can get really fun because it\u2019s not always a one size fit all. You\u2019re always going to have different kinds of controls, different layers of controls, and that should be adequately and properly reflected in your policies. There\u2019s always that adaptability aspect to it. You\u2019re watching it exactly the way that we.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Yeah. Then, we\u2019re executing. It\u2019s these controls, a lot of which is us going and acquiring software or configuring existing software too, that we don\u2019t have to maintain compliance as a burden. It\u2019s just going to be automated for us. For example, Laika is connected to our HR platform. It\u2019s connected to our G suite. It\u2019s connected to our AWS environment, and it can go out and discover places where we aren\u2019t compliant and alert us to that so that we can go and deal with those things. We also had to acquire an endpoint protection system for the organization, no more where it could be like, Hey, did you install an antivirus program on that laptop that we bought you? Now it\u2019s actually measured, and we understand, we have an enterprise wide view and it\u2019s capturing the evidence that we need to be able to satisfy beyond it. We\u2019re doing that as we\u2019re executing, the controls are working in, all of this additional, I say, all of this, it hasn\u2019t been that much, but this software configuration and that kind of stuff, to make sure that we\u2019re compliant there.<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>I think point number three is going to be really impactful for you guys. Once you kind of get into your type 2, because through the integrations, now that we\u2019re pulling in continuous data, you\u2019re not going to need to upload those pieces of evidence. We\u2019re going to be able to continuously monitor the same way the type two is going to be continuously testing. So, I would say that for you guys, you\u2019ve kind of gone through the toughest part. You\u2019ve kind of had to sit down and re like, look at your posture as it exists, figure out what the gaps are, figure out what the Delta is. Now. It\u2019s kind of just the runway. It\u2019s kind of taking off now and monitoring and making sure that you\u2019re just going to continuously do this. So, these four points have been highlighted.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Yeah. And, the operationalization of compliance for us, I think the thing that we\u2019re doing that I\u2019m actually excited about is we\u2019re putting a once a quarter compliance day on our calendar. And, I mean, the idea is that we\u2019re small enough. We can get everybody in a room and we can say, okay, we have to run our DR tests, Daniel go run the DR Test. We have to have a meeting of the risk committee to review our risks and understand, identify any additional risks that should be put on there. We have to capture minutes of that meeting. Let\u2019s just get that knocked out in the next 30 minutes. We\u2019ll have this standard agenda that once a quarter, we\u2019ll get together and we\u2019ll execute all of this stuff, and that\u2019s going to be the vast majority of the actual compliance work that isn\u2019t just automated through the software solutions that we\u2019ve got in place.<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Yeah. It looks like you\u2019ll be enacting an oversight committee charter to make sure that everything is happening and that quarterly, I\u2019m so excited. You guys are doing great.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>That\u2019s kind of it. I mean, it\u2019s not that complex once you get in and do it. It has not been nearly as burdensome as we feared that it could be. I\u2019m just excited that we are taking this journey, and we are close to graduating at the type 1 level. It\u2019s been great to work with you and Laika.\u00a0<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>It\u2019s been really great to work with you guys, and I\u2019m really excited to see you grow and ultimately, you\u2019ll take on other frameworks, and we\u2019ll work together to kind of build that up together. And, that\u2019s what we\u2019re really here for. Like right now, we did SOC 2, but just know that we\u2019re your compliance buddy, your support, and as you kind of take on, you new things are going to be there.\u00a0<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Yeah. I mean, that\u2019s a great point because, like, SOC 2 is just the first. We need to do the ISO 27,001 that you talked about. The nice thing is that all the controls that are built into Laika actually shows us that, in enacting your SOC 2, you\u2019re actually 80% or X percent of the way to having ISO 27,001 completed, so when it is time for us to do that, I think it\u2019s going to be pretty straightforward.\u00a0<\/p>\r\n\r\n\r\n\r\n<p>So, We have an incoming question. Yeah, sure. I\u2019m taking a look at the question. So, have our customer specifically asked to read the SOC 2 report once you have it? They have certainly asked to see the SOC 2 documentation. I don\u2019t have it yet, but it is. I think what they want to see is the type 2 documentation when they ask that the people that care enough to ask for that aren\u2019t going to be satisfied with the type 1. We do anticipate that this is a document that will probably be shared under some non-disclosure type of agreement, but certainly is going to be a customer-facing piece of evidence.\u00a0<\/p>\r\n\r\n\r\n\r\n<p>Are there any procedure changes you made because of this that you like? Yeah, so, I think that\u2019s the biggest one. I hate to say I\u2019m excited about Compliance Day, but I am excited about us making this a team event. Compliance isn\u2019t something now that we\u2019ll have somebody working in the wings to deal with, and you\u2019ll be given the training. You need to be satisfied and take care of a deadline, but rather it\u2019s something we\u2019re going to rally the organization around. I think it\u2019s going to be team building. I\u2019ve always been the kind of person that thinks real team building happens while you\u2019re doing the work, not while you\u2019re celebrating the work, and we\u2019ll probably figure out how to celebrate compliance day every quarter. The interesting thing is going to be actually working together on that.<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>I really liked that you brought that up because, just as a side note, the idea of compliance and security has such a deep view of trust and trust is such an important basis of compliance. I liked that this is also a team building activity because internally as you\u2019re discussing these topics, they\u2019re so important. They\u2019re really rooted in trust. You end up kind of trusting the people you\u2019re talking to, and you build that kind of team camaraderie because of the importance of this. So, I\u2019m really glad that\u2019s the lens that you\u2019re looking at. That\u2019s the lens that I look at. It\u2019s a really big value proposition.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>I saw another question come in: what do we recommend that a SAS company considering SOC 2 do to prepare for this?<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat<\/strong> <strong>Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Okay. A few things, I would start with HR, look into how you\u2019re doing your onboarding, your off-boarding, your access reviews, employee headcount. You want to start making sure you have a very clear, robust process in place for doing any HR processes. From there, from a technical standpoint, the biggest one that I always say is start looking into your endpoints. So mobile devices, computers, laptops, cell phones. How are you managing those? How are you protecting those? So, like Doug mentioned earlier, getting that MDM solution to make sure that all your laptops are encrypted. All of them have USB blocking. All of them Airdrop is turned off. How are you centrally managing all of that? So those would be like the two biggest areas that I would definitely kind of start off with. They tend to be the heaviest areas. Doug, what was your experience?<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Yeah, I think I would agree with all that. I\u2019d also layer in like the vendor management side of it has been important. I think we\u2019ve benefited tremendously that we have built our solution largely on first-party AWS services. Because of that, we don\u2019t have to go chase down a dozen different vendors to figure out their compliance story. Are they compliant with what we\u2019re saying ours is going to be, and whatnot? And, and just those, I mean, honestly, these things are architectural decisions that you make while you\u2019re building a SAS product. If you have made those decisions without, I guess being intentional about it, you might find that you have things that are difficult to unwind as you go forward. Security practices are the same way. Honestly, if you built a bunch of automation that requires you to manage passwords in an insecure way so that your nightly builds can run, then you\u2019re going to have to do engineering efforts to unwind that kind of stuff.<\/p>\r\n\r\n\r\n\r\n<p>Luckily, my CTO is a really good engineer. I wouldn\u2019t trust myself to have done all right, but he\u2019s done compliance before. And, we were in pretty good shape when we got started here. I guess the next question I see here is: was it difficult for me to sell this internally? I think the answer was no because I could go and tell my team that this customer asked for it, and this customer asks for it. And, at the end of the day, we\u2019re building a business and the team, even the developers, care about the business results. I have one of the developers on the team whose full-time job right now is to make sure that we are doing the SOC 2 stuff correctly. It\u2019s not a labor of love for him. He\u2019s excited about it being done, but that said, he understands the business needs.<\/p>\r\n\r\n\r\n\r\n<p>He\u2019s growing and learning through this, this experience he\u2019s not had in his career before. That is certainly helping keep him optimistic on the whole process. So, and somebody asks, are they not annoyed with the procedures? Well, I mean, the secret is to involve them in writing the procedure so that they\u2019re not annoying. Yeah. I mean, a classic example is change management. You can have a really onerous change management process. It says that you have to have all these pre-approvals before you do anything. You have post approvals before you deploy anything and all that kind of stuff. Or you can do what we did and say, we already use JIRA to manage our stuff. Every time we\u2019re going to start new work, we need an epic in JIRA that has a brief, like one pager description of that. Break it down into tasks, execute those tasks. The fact that we documented it, not epic, and that it was approved in a daily standup meeting that all of us were involved in is sufficient for us to satisfy that. I think that procedures can be aligned with the way that the teams are already executing so that it doesn\u2019t mean you\u2019re putting a bunch of overhead in place.\u00a0<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>You don\u2019t necessarily have to always change things when you\u2019re doing it. In this case, you already kind of had an informal procedure in place. You just documented it. And that was really the new procedure, your documentation in the policy.<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>I\u2019m not a zoom wizard, but I don\u2019t see any, oh, I see one other person say, what\u2019s the cost to get SOC 2 compliant? Well, there are many ways that you can go about doing it as I understand it. Mentioned earlier, I had heard multiple people give me six-figure price tags on what it would take to do it. I would say for us, it\u2019s probably going to be a quarter of that at the end. So, it turned out to be way more affordable than I thought. I put a lot of money into our budget to get it done this year. I\u2019m not even really scratching the surface of that. That said, it\u2019s going to depend on how you do it. And, I think there are some ways you can pay consultants to come in and do a lot of the stuff that we as a team have signed up to do ourselves. That\u2019s really not the way Arpio operates. We\u2019re a bunch of doers. We like to build stuff, even sometimes policies.\u00a0<\/p>\r\n\r\n\r\n\r\n<p>We are trying to see if there are any other questions then. Any product changes that you came up with because of this, like to make SOC 2 easier for your customers? One of the things I thought, a misconception I had was that Sim was going to show up and tell us that we have to change our product, but we have to add a bunch of security features into the product or anything like that. We haven\u2019t had to do any of that stuff. The way that our product was engineered for our customers is sufficient for us to get the SOC 2 certification. Our product is quite secure, but we can always be doing more and especially why around things like single sign-on and multifactor authentication and stuff like that we will have in the product, in the not-too-distant future, but they\u2019re not there today, and they aren\u2019t blockers for us to move forward.<\/p>\r\n\r\n\r\n\r\n<p>A question just came in and said, is there a list of required documentation or policies that need to be in place?<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Absolutely. In fact, we have a list for SOC 2. We have a list for ISL. We have a list for GDPR. We have a list for HIPAA. We have a list for pivotal. We have a list for all of it.\u00a0<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>I actually have my Laika policies up here. Okay. I think people can still see the ten policies that we are doing. I don\u2019t know if these P\u2019s are a priority, but I do think of them in this particular order. So, from information security, business, continuity, compliance, configuration management, all of the stuff. Again like this was built into Laika, we didn\u2019t have to go off of these policies. We just had to go review them and iterate. And right-size them for us.<\/p>\r\n\r\n\r\n\r\n<p><strong>Simrat Singh<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Those are the policies, I love them.\u00a0<\/p>\r\n\r\n\r\n\r\n<p><strong>Doug Neumann<\/strong><\/p>\r\n\r\n\r\n\r\n<p>Great. Well, I think that we are at the end here, it\u2019s been 40 minutes of people listening to me, droning on about compliance, which is probably not the most entertaining way people could have spent this time, but all that said, I appreciate everyone joining us. Sim, I really appreciate you sharing this time, as well as just all of the mentorship you\u2019ve given us as we\u2019ve gone through this process.<\/p>\r\n<\/body>","protected":false},"excerpt":{"rendered":"<p>\u00a0 Doug Neumann Thanks for joining us today, everyone. We\u2019re excited to tell you about some SOC 2 stuff. This webinar is going to be my journey, Arpio\u2019s journey, pursuing&#8230;<\/p>\n","protected":false},"author":1,"featured_media":953,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"nf_dc_page":"","content-type":"","inline_featured_image":false,"footnotes":""},"categories":[3],"tags":[],"class_list":["post-966","post","type-post","status-publish","format-standard","has-post-thumbnail","category-blog"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.9 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>SOC 2 Compliance - Can it be done in 6 weeks? [webinar] - Arpio Disaster Recovery Made Easy<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SOC 2 Compliance - Can it be done in 6 weeks? [webinar] - Arpio Disaster Recovery Made Easy\" \/>\n<meta property=\"og:description\" content=\"\u00a0 Doug Neumann Thanks for joining us today, everyone. We\u2019re excited to tell you about some SOC 2 stuff. This webinar is going to be my journey, Arpio\u2019s journey, pursuing...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/\" \/>\n<meta property=\"og:site_name\" content=\"Arpio Disaster Recovery Made Easy\" \/>\n<meta property=\"article:published_time\" content=\"2021-09-15T15:37:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-08-05T20:55:10+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/arpio.io\/wp-content\/uploads\/2021\/08\/SOC-2-Compliance-For-SaaS-Companies-How-Hard-Is-It.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"627\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"6805pwpadmin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"6805pwpadmin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"28 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/\"},\"author\":{\"name\":\"6805pwpadmin\",\"@id\":\"https:\/\/arpio.io\/staging\/8013\/#\/schema\/person\/0a2437a37056190db7e46201a6a65095\"},\"headline\":\"SOC 2 Compliance &#8211; Can it be done in 6 weeks? [webinar]\",\"datePublished\":\"2021-09-15T15:37:00+00:00\",\"dateModified\":\"2022-08-05T20:55:10+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/\"},\"wordCount\":6597,\"image\":{\"@id\":\"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/arpio.io\/staging\/8013\/wp-content\/uploads\/2021\/08\/SOC-2-Compliance-For-SaaS-Companies-How-Hard-Is-It.png\",\"articleSection\":[\"Blog\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/\",\"url\":\"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/\",\"name\":\"SOC 2 Compliance - Can it be done in 6 weeks? [webinar] - Arpio Disaster Recovery Made Easy\",\"isPartOf\":{\"@id\":\"https:\/\/arpio.io\/staging\/8013\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/arpio.io\/staging\/8013\/wp-content\/uploads\/2021\/08\/SOC-2-Compliance-For-SaaS-Companies-How-Hard-Is-It.png\",\"datePublished\":\"2021-09-15T15:37:00+00:00\",\"dateModified\":\"2022-08-05T20:55:10+00:00\",\"author\":{\"@id\":\"https:\/\/arpio.io\/staging\/8013\/#\/schema\/person\/0a2437a37056190db7e46201a6a65095\"},\"breadcrumb\":{\"@id\":\"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/#primaryimage\",\"url\":\"https:\/\/arpio.io\/staging\/8013\/wp-content\/uploads\/2021\/08\/SOC-2-Compliance-For-SaaS-Companies-How-Hard-Is-It.png\",\"contentUrl\":\"https:\/\/arpio.io\/staging\/8013\/wp-content\/uploads\/2021\/08\/SOC-2-Compliance-For-SaaS-Companies-How-Hard-Is-It.png\",\"width\":1200,\"height\":627},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/arpio.io\/staging\/8013\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SOC 2 Compliance &#8211; Can it be done in 6 weeks? [webinar]\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/arpio.io\/staging\/8013\/#website\",\"url\":\"https:\/\/arpio.io\/staging\/8013\/\",\"name\":\"Arpio Disaster Recovery Made Easy\",\"description\":\"AWS Disaster Recovery\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/arpio.io\/staging\/8013\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/arpio.io\/staging\/8013\/#\/schema\/person\/0a2437a37056190db7e46201a6a65095\",\"name\":\"6805pwpadmin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/arpio.io\/staging\/8013\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/bbce7316dd4979a6199ddcdaed836e357939826f60c7be919373136535d247b6?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/bbce7316dd4979a6199ddcdaed836e357939826f60c7be919373136535d247b6?s=96&d=mm&r=g\",\"caption\":\"6805pwpadmin\"},\"sameAs\":[\"http:\/\/support.pagely.com\"],\"url\":\"https:\/\/arpio.io\/staging\/8013\/author\/6805pwpadmin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SOC 2 Compliance - Can it be done in 6 weeks? [webinar] - Arpio Disaster Recovery Made Easy","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/","og_locale":"en_US","og_type":"article","og_title":"SOC 2 Compliance - Can it be done in 6 weeks? [webinar] - Arpio Disaster Recovery Made Easy","og_description":"\u00a0 Doug Neumann Thanks for joining us today, everyone. We\u2019re excited to tell you about some SOC 2 stuff. This webinar is going to be my journey, Arpio\u2019s journey, pursuing...","og_url":"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/","og_site_name":"Arpio Disaster Recovery Made Easy","article_published_time":"2021-09-15T15:37:00+00:00","article_modified_time":"2022-08-05T20:55:10+00:00","og_image":[{"width":1200,"height":627,"url":"https:\/\/arpio.io\/wp-content\/uploads\/2021\/08\/SOC-2-Compliance-For-SaaS-Companies-How-Hard-Is-It.png","type":"image\/png"}],"author":"6805pwpadmin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"6805pwpadmin","Est. reading time":"28 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/#article","isPartOf":{"@id":"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/"},"author":{"name":"6805pwpadmin","@id":"https:\/\/arpio.io\/staging\/8013\/#\/schema\/person\/0a2437a37056190db7e46201a6a65095"},"headline":"SOC 2 Compliance &#8211; Can it be done in 6 weeks? [webinar]","datePublished":"2021-09-15T15:37:00+00:00","dateModified":"2022-08-05T20:55:10+00:00","mainEntityOfPage":{"@id":"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/"},"wordCount":6597,"image":{"@id":"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/#primaryimage"},"thumbnailUrl":"https:\/\/arpio.io\/staging\/8013\/wp-content\/uploads\/2021\/08\/SOC-2-Compliance-For-SaaS-Companies-How-Hard-Is-It.png","articleSection":["Blog"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/","url":"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/","name":"SOC 2 Compliance - Can it be done in 6 weeks? [webinar] - Arpio Disaster Recovery Made Easy","isPartOf":{"@id":"https:\/\/arpio.io\/staging\/8013\/#website"},"primaryImageOfPage":{"@id":"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/#primaryimage"},"image":{"@id":"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/#primaryimage"},"thumbnailUrl":"https:\/\/arpio.io\/staging\/8013\/wp-content\/uploads\/2021\/08\/SOC-2-Compliance-For-SaaS-Companies-How-Hard-Is-It.png","datePublished":"2021-09-15T15:37:00+00:00","dateModified":"2022-08-05T20:55:10+00:00","author":{"@id":"https:\/\/arpio.io\/staging\/8013\/#\/schema\/person\/0a2437a37056190db7e46201a6a65095"},"breadcrumb":{"@id":"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/#primaryimage","url":"https:\/\/arpio.io\/staging\/8013\/wp-content\/uploads\/2021\/08\/SOC-2-Compliance-For-SaaS-Companies-How-Hard-Is-It.png","contentUrl":"https:\/\/arpio.io\/staging\/8013\/wp-content\/uploads\/2021\/08\/SOC-2-Compliance-For-SaaS-Companies-How-Hard-Is-It.png","width":1200,"height":627},{"@type":"BreadcrumbList","@id":"https:\/\/arpio.io\/soc-2-compliance-can-it-be-done-in-6-weeks\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/arpio.io\/staging\/8013\/"},{"@type":"ListItem","position":2,"name":"SOC 2 Compliance &#8211; Can it be done in 6 weeks? [webinar]"}]},{"@type":"WebSite","@id":"https:\/\/arpio.io\/staging\/8013\/#website","url":"https:\/\/arpio.io\/staging\/8013\/","name":"Arpio Disaster Recovery Made Easy","description":"AWS Disaster Recovery","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/arpio.io\/staging\/8013\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/arpio.io\/staging\/8013\/#\/schema\/person\/0a2437a37056190db7e46201a6a65095","name":"6805pwpadmin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/arpio.io\/staging\/8013\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/bbce7316dd4979a6199ddcdaed836e357939826f60c7be919373136535d247b6?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/bbce7316dd4979a6199ddcdaed836e357939826f60c7be919373136535d247b6?s=96&d=mm&r=g","caption":"6805pwpadmin"},"sameAs":["http:\/\/support.pagely.com"],"url":"https:\/\/arpio.io\/staging\/8013\/author\/6805pwpadmin\/"}]}},"_links":{"self":[{"href":"https:\/\/arpio.io\/staging\/8013\/wp-json\/wp\/v2\/posts\/966","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/arpio.io\/staging\/8013\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/arpio.io\/staging\/8013\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/arpio.io\/staging\/8013\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/arpio.io\/staging\/8013\/wp-json\/wp\/v2\/comments?post=966"}],"version-history":[{"count":2,"href":"https:\/\/arpio.io\/staging\/8013\/wp-json\/wp\/v2\/posts\/966\/revisions"}],"predecessor-version":[{"id":1658,"href":"https:\/\/arpio.io\/staging\/8013\/wp-json\/wp\/v2\/posts\/966\/revisions\/1658"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/arpio.io\/staging\/8013\/wp-json\/wp\/v2\/media\/953"}],"wp:attachment":[{"href":"https:\/\/arpio.io\/staging\/8013\/wp-json\/wp\/v2\/media?parent=966"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/arpio.io\/staging\/8013\/wp-json\/wp\/v2\/categories?post=966"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/arpio.io\/staging\/8013\/wp-json\/wp\/v2\/tags?post=966"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}