How StepSecurity Achieved SOC 2 With Limited Resources

4 weeks Time to complete SOC 2 Type 1 audit

2 weeks To become audit-ready after implementing Sprinto

1 hour To complete setup across AWS resources, org chart, training and repositories

Before Sprinto

After Sprinto

Enterprise organizations with private repositories, predominantly in regulated industries such as healthcare and finance, wanted to work with partners that were SOC 2 compliant.

StepSecurity completed its SOC 2 Type 1 audit in 4 weeks with Prescient Assurance from Sprinto’s auditor network, and is now unblocking commercial deals and clearing its fast-growing sales pipeline.

As a first-time startup with limited resources, SOC 2 looked like a costly, time-consuming process that would pull focus away from customer acquisition and revenue growth.

Through Sprinto Ignite, StepSecurity got a price point that worked for a startup, finished setup in 1 hour, and was audit-ready 2 weeks after implementing Sprinto, with the founders still on growth.

Without the dedicated compliance function larger enterprises staff with project managers, program managers, and CISOs, StepSecurity had no easy way to see where security gaps sat or to get evidence in front of auditors.

StepSecurity runs continuous monitoring in Sprinto, where the tiered escalation system for failing checks flags gaps and how to fix them, and the audit dashboard showed the auditors evidence exactly as they needed to see it.

“SOC 2 compliance usually requires a substantial amount of time, resources, and investment. Larger enterprises typically have teams dedicated to managing security compliance, including project managers, program managers, and CISOs working in tandem to ensure compliance with regulations. As a startup, we were laser-focused on customer acquisition and revenue growth. We didn’t want to be sidetracked by the heavy lift of SOC 2 compliance.”

– Ashish Kurmi
Co-founder, StepSecurity

“To my amazement, the process was not only seamless but also hassle-free. Our CSM played a pivotal role in making this experience so incredibly remarkable for our team,”

– Ashish Kurmi
Co-founder, StepSecurity

Introduction

In late 2021, security veterans Varun Sharma and Ashish Kurmi came together to build StepSecurity, a platform for developers to implement software supply chain security best practices with ease in minutes. StepSecurity empowers developers to defend against software supply chain attacks by automating security best practices, letting them quickly discover and integrate DevSecOps tools into software development and delivery pipelines, and remediate security issues through automated pull requests with just one click.

StepSecurity started as a company that helped open-source maintainers and communities with their software supply chain security. As it continued to grow, StepSecurity started seeing a lot of requests from large enterprise organizations with private repositories that had the same security issues. These organizations were predominantly from regulated industries such as healthcare and finance, and they wanted to work with partners that were SOC 2 compliant.

The Problem

Ashish and Varun both come from a security background and have helped several large-scale enterprises with their SOC 2 journeys in the past. Being a first-time startup with limited resources, though, SOC 2 compliance looked like a costly and time-consuming process that would take attention away from more pressing priorities. “SOC 2 compliance usually requires a substantial amount of time, resources, and investment. Larger enterprises typically have teams dedicated to managing security compliance, including project managers, program managers, and CISOs working in tandem to ensure compliance with regulations. As a startup, we were laser-focused on customer acquisition and revenue growth. We didn’t want to be sidetracked by the heavy lift of SOC 2 compliance,” says Ashish Kurmi, Co-founder, StepSecurity.

As they started working with more customers, Ashish and Varun realized that SOC 2 compliance was a huge business opportunity that they couldn’t ignore. With limited resources and tight timelines, StepSecurity needed a security compliance tool that would get it SOC 2 compliant fast and within budget. “We started evaluating tools in the market, and they all promised a high degree of automation. But when I got on a call with Sprinto, I could clearly see the high level of automation that is built into the product, and I was convinced that Sprinto would make a perfect choice!” notes Ashish.

StepSecurity signed up for Sprinto Ignite, a curated security compliance enablement program for tech startups. “Compared to other platforms, Sprinto made sense because of Ignite – it was so much more affordable. As a startup we appreciated the pricing,” the founders note.

The Solution

During the kickoff call, StepSecurity received a meticulous action plan for each phase of its SOC 2 journey. Because StepSecurity uses a modern tech stack and operates exclusively on AWS, setup moved quickly: organizing the organization chart, conducting employee security training, and categorizing repositories and AWS resources were all done within an hour, and StepSecurity was up and running without delay. “Although we did have weekly calls after the initial setup, the streamlined process felt effortless, and everything seemed to run on autopilot,” notes Ashish.

From there, StepSecurity worked through its security gaps using Sprinto’s continuous monitoring and managed its policies in the same place. “What stood out for me about Sprinto is that it is very action-oriented. It tells you exactly where the security gaps are and how you can fix them. The tiered escalation system for failing checks is amazing and turned out to be invaluable in guiding us towards identifying and prioritizing issues that required immediate attention,” says Ashish.

Drawing from prior experience, Ashish had anticipated that achieving SOC 2 compliance would take up a lot of their time and effort, and he was pleasantly surprised to see Sprinto’s customer success team support every aspect of the journey from start to finish, leaving no detail overlooked. “To my amazement, the process was not only seamless but also hassle-free. Our CSM played a pivotal role in making this experience so incredibly remarkable for our team,” adds Ashish.

Within 2 weeks of implementing Sprinto, StepSecurity was ready for audit and chose Prescient Assurance from Sprinto’s auditor network for its SOC 2 certification. “I was bracing myself for an intensive involvement during the audit process as well, preparing to walk the auditors through every little detail and answering their barrage of questions. But to my delight, Team Sprinto was our first point of contact for the auditors, and they effortlessly fielded all the queries that came their way. They also provided the auditors with access to the audit dashboard within Sprinto, which showcased evidence exactly as they needed to see it,” says Ashish.

Impact

Over the next two weeks, StepSecurity completed its audit and received its SOC 2 Type 1 audit report. “Thanks to Sprinto, we pulled it off with such finesse!” adds Ashish.

SOC 2 Type 2 and ISO 27001 are next in line for StepSecurity and already in motion. Since becoming compliant, StepSecurity has amped up its sales effort and is actively working on unblocking commercial deals and clearing its fast-growing sales pipeline.