Security Compliance

The original way to evaluate a new tool was to ask the vendor directly. A buyer sent over a list of questions: which country the servers sit in, who inside the vendor can open customer data, how many hours pass before anyone gets told about a breach. The vendor wrote fresh answers every time. The questions were nearly the same from buyer to buyer, but the forms never were, so last week's answer to one customer got copied by hand into this week's spreadsheet for another.

The buyer did not end up in a better place either. A line that says access permissions are reviewed regularly leaves nothing to do with it. How many months is regularly, when was the last review, what did it turn up — none of that is in the sentence, and asking gets you one more sentence. A company running twenty vendors cannot work through twenty of these.

The volume grew for a reason. When companies installed software on their own servers, the data stayed inside their own walls. Moving the same work onto services that run on someone else's machines put customer lists and signed contracts into the database of a company nobody in the building had met, and security teams started showing up in purchase decisions. From the selling side, that is one more person to convince.

Pagedeck got stuck at exactly that step. The first enterprise security questionnaire Sofia brought back ran past a hundred items. Theo filled in half the technical ones and Grace covered the contract section, but the rest went back blank because nobody in the company knew the answers. The customer's security team attached follow-up questions to every blank and sent it again. Three rounds later, three months had gone by. The deal slipped on a spreadsheet, not on features or price.

Security compliance exists to turn that loop into a single pass. The checklist is published in advance, an assessor from outside the company works through it once, and the result comes out as a certificate. It has the same shape as a hygiene grade posted on a restaurant door for diners who cannot walk into the kitchen. The buyer inspects twenty kitchens through twenty certificates, and the vendor sits one assessment instead of filling out twenty forms. What the arrangement removes is not doubt but the cost of resolving it. Buyers still decide how far to trust a report, but they start from the report and ask about the few items it leaves open rather than re-deriving all hundred.

The terms under this name fall into three branches. What the company has committed to is the makeup, checking that the commitments are kept is the procedure, and the result shown to the outside world is the certification. The order looks inverted at first. The certificate reads like the goal and the rest like preparation, but the first two branches are where the months actually go.

Makeup is the raw material an assessment runs on. There are two terms here.

1. Control — one management measure put in place to reduce one risk. Lock a departing employee's account on their last working day; require two approvals to reach the production database. Each is written as a single sentence and each is either met or not. A checklist is a bundle of several dozen to a few hundred of these, and the company writes down how it handles every one.
2. Evidence — the record showing the control was actually followed. Not a claim that the account was locked but the screen carrying the date and the person who did it. Not a claim that approval happened but the log with the request and the approval on it. Assessors read this rather than the policy document. Companies that fall behind usually have the rules; what they lack is any trace of having followed them. The acceptable forms are set too. A log the system writes on its own beats a table someone retyped, and a record that returns the same result whenever it is pulled beats a screenshot captured in the moment.

Procedure covers how the checking happens. Two terms again.

1. Audit — the process of confirming that operations match what was written down. It splits into an internal audit the company runs on itself and an external assessment run by a qualified assessor. Internal usually comes first. A dry run surfaces the controls with no evidence behind them, and the same gap found during the external round stays in the report as a finding even after it gets fixed.
2. Vendor assessment — the company checking the outside tools and providers it uses. It is the customer's question passed one level down. Customer data does not stop at your own servers; it flows on to the company sending your notification emails and the tool holding your support tickets, so your certification covers them too. Sign up a new tool without collecting its certificate alongside the contract and you will be emailing twenty providers two months before an assessment.

The first thing procedure settles is scope. No company gets every system assessed at once. A line is drawn around certain services and systems, and the controls are checked inside that line. Draw it tight and preparation finishes sooner, but the exact feature a customer asked about may sit outside the certificate. Draw it wide and the internal experiment server has to be managed to the same standard. Where the line goes is not a technical call; it is a decision about which customers get shown what.

Certification is the branch of certificates you receive as output. Three of them, sorted by which region and which buyers they speak to.

1. ISMS-P — Korea's national scheme, covering information security management and personal information management in one assessment. Companies past a certain revenue or user count are required by law to hold it, so inside Korea the question is often not whether to pursue it but whether you already fall under it.
2. SOC 2 — System and Organization Controls 2, the standard used in the United States. It does not come back as a pass or a fail but as a report written by an accounting firm, and it splits into one type that looks at whether controls are designed correctly at a single point in time and another that watches whether they were actually followed across six to twelve months. Enterprise buyers usually want the second, which is why the stretch from starting preparation to holding a report runs close to a year.
3. ISO/IEC 27001 — the international standard. Its value is that the name alone explains itself to a customer in any country. It is not a one-time award: a surveillance audit comes every year, and every few years the whole thing is done again from the start.

The three do not substitute for one another. More than half of what they ask overlaps, but the checklists are named differently and the evidence is formatted differently, so selling into several markets means holding several certificates. Which one comes first is decided by where the currently blocked deals are. The second one is cheaper than the first, though. Evidence for overlapping controls like access reviews and offboarding gets reused as is, and once you map which item on one checklist answers which item on the other, later rounds mostly reformat material you already have.

All three branches point at the same object: security governance. Certification does not build a program that was not there. It transcribes the rules and procedures a company already runs into a form outsiders can read, and checks whether they live on paper or in practice.

"This one doesn't move forward without SOC 2. They'll take a roadmap in the meantime."

A dated plan for what you will hold and when can keep a deal alive before the certificate exists.

"We set that control, but there's no evidence for it. We need to reconstruct the last six months."

The rule is in place and the record of following it is not, so the assessment catches it anyway.

"The feature we shipped this quarter isn't inside the certification scope."

A certificate attaches to the services and systems named at assessment time, not to the company as a whole.

After living through one three-month loop, Pagedeck reversed the order. Sofia counted the deals that stalled over the last two quarters: seven of eleven stalled for the same reason, and five of those seven were United States customers. That count is why Grace chose SOC 2 first. Theo moved checklist items into the backlog like features and cleared a few each sprint, and Mia added one line to the feature brief asking whether the feature lands inside the scope.

Evidence is where the gap shows up most often. That following a rule and recording that you followed it are two separate jobs tends to become clear only once an assessment is close. Pagedeck had been reviewing access permissions every quarter, but the reviews happened in chat threads, so the first internal audit found three quarters of work that formally never happened. Now every review ends with a note in one fixed place saying who checked what.

What changes once the report lands is not the content of the answers but how long they take. Sofia answers most items on a new questionnaire by lifting them straight out of the report and passes the few it does not cover to Theo. The three-month loop turns into a week.

The most common mistake is reading a certificate as proof that nothing can get through. Passing an assessment sounds close enough to being safe that the leap is easy to make. What certification looks at, though, is whether defined procedures exist and run as defined, not whether real attacks get stopped. Weaknesses left in code and mistakes in configuration belong to application security, and a company that has never done that kind of testing can still hold a certificate. The door comparison makes it clearer: certification checks that the lock works, that someone knows how many keys exist and who holds them, and that a named person changes the lock when one goes missing. It does not put anyone against the door to see whether it can be forced. Leaving this mistake in place costs you the explanation later. What the customer asks after an incident is how this happened at a certified company, and the certificate answers nothing.

Treating it as finished once earned is the other common one. It looks like an exam, and exams end when you pass. In practice certificates carry expiry dates, a surveillance audit lands every year, and evidence has to keep accumulating month by month in between. Features built after the assessment and tools connected after it arrive at the next round as things nobody has looked at yet. Miss this and you spend the two months before the next assessment manufacturing six months of records, which is the point where writing down work that was never done starts to look attractive. Evidence built that way surfaces the moment an assessor lines it up against the original logs, and the consequence is heavier than missing one control would have been.