627 karma · joined August 17, 2017
* It costs $40k in year one and $30k/year in subsequent years if you do the now typical stack of Vanta, pen test, vulnerability monitoring and audit fees. This makes ROI pretty straight forward to figure out.
* There's really no benefit to getting Type 1, you just need to get the Type 1 posture and then wait out the monitoring period in order to get type 2. If the customers actually care, they are smart enough to know that it's a lot harder to fudge it for 6 months than it is for one four hour Zoom call.
* You can definitely get to about 60% of SOC2 just doing obvious best practice (code reviews, SSO, HTTPS only, database alerting). The next 20% is worthwhile but not intuitive, the final 20% is neither.
Agreed with the top comment about infosec teams being reasonable. At this point I think it would be pretty hard to do deals with public companies without having Type 2, and our domain isn't even that security focused.
The concept of a go bag for the hospital also was very important and would have saved four or five family trips to our place.
Get the most expensive peri bottles you can, not the hospital ones.
More people than you think faint during the birth, if you're sensitive, prepare to fight your parasympathetic system. Do the breathing exercises regardless of your role!
I was completely outside time and space for two weeks, very tired for four months and it took 18 months to feel as sharp as I did pre birth and I was the support system not the main character :)
Get a really long phone charger for the hospital, naturally the plugs around the bed are used by machines but not the far away ones. Naturally they don't have them on site so bring your own.