u/ConribufotionWeak310

Australian SaaS team, just under 30 people, and we're trying to work out what ISO 27001 certification is realistically going to cost us.

I thought we'd get a few quotes, compare them, pick one and move on. instead every quote seems to be describing a slightly different project.

one assumes we already have most of the ISMS in place. another bundles a lot of prep but leaves the audit separate. another looks cheap until you start asking who writes the policies, who closes the gaps, who gathers the evidence and how much engineering time is still expected from us.

that's the bit making me nervous. I'm not even sure I'm comparing the same thing anymore.

the actual certification fee is almost the least confusing number in the spreadsheet. I'm more worried about signing something that looks reasonable, then finding out three months in that we're still doing half the work ourselves and paying separately for the rest.

right now I'm breaking everything out into platform or consultant, auditor, pen test, internal hours and ongoing maintenance because "all-in" seems to have a very flexible definition.

Our SOC 2 prep is still a monthly scavenger hunt through Google Drive, Jira and Slack, so I'm starting to wonder if compliance automation is finally worth paying for. latest example was trying to prove MFA was in place back in March. evidence existed somewhere. nobody knew where the useful version was. half an hour turned into three people checking folders and old tickets. the subscription prices aren't exactly tiny, but neither is repeatedly pulling Eng or IT into this stuff. what would you count when deciding if the spend is justified? I'm trying to put a number on the hours we're already losing to evidence work.

So... im the security engineer at a tiny saas startup trying to get SOC 2 ready before our audit window next month. We use a compliance automation platform hooked into github, aws, our ticketing, all that, to auto pull evidence and show real time compliance.

Yesterday I thought I was being helpful and created a "fast track" tag in our repo so engineers could push hotfixes without our usual security review tickets. I figured I would just document it once and map the tag to a control in the platform later. Except I forgot that the platform is the source of truth our auditor portal is connected to.

So this morning the auditor emails our CTO saying they noticed a huge spike in unreviewed code deployments flagged as "approved" in the compliance dashboard, tied to my fast track workflow that auto closed the security tickets as passed. It literally looked like we built a system to rubber stamp anything to prod with zero checks. I feel so embarrassed and kind of sick about this, our CTO just wrote "we will need to discuss" and added me and legal... ugh.