{"id":13969,"date":"2023-11-14T15:33:19","date_gmt":"2023-11-14T15:33:19","guid":{"rendered":"http:\/\/TheNextWeb=1400923"},"modified":"2023-11-14T15:33:19","modified_gmt":"2023-11-14T15:33:19","slug":"everything-startups-need-to-know-about-building-a-security-compliance-program","status":"publish","type":"post","link":"https:\/\/www.londonchiropracter.com\/?p=13969","title":{"rendered":"Everything startups need to know about building a security compliance program"},"content":{"rendered":"\n<div><img decoding=\"async\" src=\"https:\/\/img-cdn.tnwcdn.com\/image\/tnw-blurple?filter_last=1&amp;fit=1280%2C640&amp;url=https%3A%2F%2Fcdn0.tnwcdn.com%2Fwp-content%2Fblogs.dir%2F1%2Ffiles%2F2023%2F10%2FAdd-a-heading-1.jpg&amp;signature=5d252088cdd0ce76ba369a5887466a09\" class=\"ff-og-image-inserted\"><\/div>\n<p>With <a href=\"https:\/\/www.ft.com\/content\/0d1d3b49-4eb9-42b4-89b3-e4c828014ccd\" target=\"_blank\" rel=\"nofollow noopener\">cybercrime on the rise across the UK<\/a> and <a href=\"https:\/\/www.vodafone.co.uk\/newscentre\/press-release\/half-of-smes-experience-surge-in-cyber-attacks-vodafone-research-reveals\/#:~:text=More%20than%20half%20(54%25),business%20up%20to%20%C2%A34%2C200.\" target=\"_blank\" rel=\"nofollow noopener\">more SMEs being targeted<\/a>, security is more important than ever before.<\/p>\n<p>Even if you believe your business is secure from data leaks and cyberattacks, if you\u2019re not able to demonstrate this to potential clients, your sales team could be missing out on growth-driving deals. This is especially the case for enterprise clients that often require potential partners to demonstrate compliance with some of the key measures such as ISO 27001 and SOC 2.<\/p>\n<p>All this means that security compliance is no longer a nice to have for UK <a href=\"https:\/\/thenextweb.com\/topic\/startup\" target=\"_blank\" rel=\"noopener\">startups<\/a>.<\/p>\n<p>Security compliance programs help your organisation identify, implement, and maintain appropriate <a href=\"https:\/\/thenextweb.com\/topic\/cybersecurity\" target=\"_blank\" rel=\"noopener\">cybersecurity<\/a> controls to protect sensitive data, comply with laws and contractual obligations, and adhere to the standards, regulatory requirements, and frameworks needed to protect customers and enable the business to succeed.<\/p>\n<h2><strong>Steps for getting started<\/strong><\/h2>\n<h4><strong>Step 1: Define your organisational goals and needs <\/strong><\/h4>\n<p>Are you starting the program to close deals? Do you want to proactively demonstrate trust or compliance? More importantly, what are you trying to accomplish and why? After answering these questions, we recommend identifying your desired end state and vetting and aligning this with key stakeholders and their needs. The more granular you can be about your intended goals and desired end state, the easier it\u2019ll be to work backward towards your objectives and bring others on board as well.<\/p>\n<div class=\"inarticle-wrapper channel-cta\">\n<div class=\"ica-text\" readability=\"0\"><a href=\"https:\/\/thenextweb.com\/conference\/tickets?utm_source=TNW-media&amp;utm_medium=display&amp;utm_campaign=TNW2024\" data-event-category=\"Article\" data-event-action=\"In Article Block\" data-event-label=\"Get your ticket NOW for TNW Conference - Super Earlybird is almost sold out!\" target=\"_blank\" readability=\"6\" rel=\"noopener\"><\/p>\n<p class=\"ica-text__title\">Get your ticket NOW for TNW Conference &#8211; Super Earlybird is almost sold out!<\/p>\n<p>Unleash innovation, connect with thousands of tech lovers and shape the future on June 20-21, 2024.<\/p>\n<p><\/a><\/div>\n<\/div>\n<p>Before worrying about which standard to implement or what tools to buy, it\u2019s critical to ensure these goals are doing <em>more<\/em> for the organisation than just unblocking deals or solving one problem.<\/p>\n<p>At <a href=\"https:\/\/www.vanta.com\/\" target=\"_blank\" rel=\"nofollow noopener\">Vanta<\/a>, we leverage our compliance efforts as force multipliers wherever possible. For instance, a known compliant process in one business unit could potentially be adapted to work in another, which could streamline cross-functional work and alignment across different projects.\u200d<\/p>\n<h4><strong>Step 2: Define your roadmap and timeline<\/strong><\/h4>\n<p>Consider breaking your timeline down into specific milestones you\u2019ll be able to track and work toward. In addition, think through whether there are any dependencies you\u2019ll need to account for and how they relate.<\/p>\n<p>This step should include identifying the answer to questions such as:\u200d<\/p>\n<ul>\n<li>What are our known technology needs or gaps?<\/li>\n<li>Do we expect we will need to invest in some additional tooling or support?<\/li>\n<li>Do we have an understanding of the technical demands of where we want to go?<\/li>\n<li>Do we build, buy, or partner?<\/li>\n<\/ul>\n<p>\u200dFor instance, if you\u2019d like to build and are planning to hire for the role, consider whether you need someone who\u2019s more of a manager who can set direction or someone who\u2019s willing to roll up their sleeves as a doer. This is especially important for a foundational role like your first compliance hire.<\/p>\n<p>If you opt to buy or partner, consider whether using services such as a virtual CISO (vCISO), Managed Service Provider (MSP), or other fractional resources could address your needs and objectives more cost-effectively. This is especially important if you have a very broad tech stack or complex operations, as an MSP or vCISO firm will usually have access to more expert resources than any one person can be expected to know.<\/p>\n<p>If you\u2019re building a program from the ground up or for the first time, it may be more cost-effective to use a trusted third party to supplement your work than to hire one or more FTEs to build a program in-house. Regardless of what option you go with, you\u2019re likely looking for an individual\u2014or even a team\u2014with privacy and\/or compliance knowledge as well as technical engineering knowledge.<\/p>\n<p>Part of defining your objectives also includes measuring your progress and ensuring that what you\u2019re measuring is relevant to your intended outcomes. As you develop your program, be sure to identify key metrics that help your organisation understand and share the achievements and outcomes of your security compliance program.<\/p>\n<p>Remember you\u2019ll need to prioritise what you\u2019ll build and when. This is especially true given that you\u2019ll likely have a long list of action items, and more tools and needs than you have budget for. The approach we\u2019ve taken at Vanta is to align our security compliance program with our business objectives\u2014which also ensures we\u2019re meeting the needs of our customers and our overall business.<\/p>\n<p>As a tip, our team likes to reference Verizon\u2019s <em>Five Constraints of Organisational Proficiency <\/em>as described in their <a href=\"https:\/\/www.verizon.com\/business\/resources\/T847\/reports\/2019-payment-security-fullreport-bl.pdf\" target=\"_blank\" rel=\"nofollow noopener\">2019 Payment Security Report<\/a> to help structure our approach to our compliance program. This framework highlights the importance of capacity, capability, competence, commitment, and communication as key to the health and effectiveness of a strong data protection compliance program\u2014we suggest giving it a quick read if you\u2019re interested!<\/p>\n<h4><strong>Step 3: Prioritise and start building <\/strong><\/h4>\n<p>Now that you have an understanding of your needs and timeline, it\u2019s time to start prioritising your efforts based on the needs and constraints of your business. You can start by taking the following steps:<\/p>\n<ul>\n<li><strong>Double-check alignment with business objectives<\/strong>\u2014is your plan still what the business needs or has it had some scope creep or plan drift that might introduce unnecessary friction?<\/li>\n<li><strong>Set up official deadlines<\/strong> based on your new understanding of the project goals, and officially kick off the implementation of your program.<\/li>\n<\/ul>\n<p>Remember, security and compliance are infinite black holes without context. Make sure that what you\u2019re planning on doing for compliance has guardrails to ensure you\u2019re spending your time and effort in places that drive measurable business outcomes.<\/p>\n<p>\u200dLastly, understanding, defining and communicating<em> why <\/em>you\u2019re working toward these objectives\u2014whether toward meeting customer needs, revenue goals, or internal risk reduction\u2014can bring others on board as well.<\/p>\n<h2><strong>Additional considerations: stakeholders and resources <\/strong><\/h2>\n<p>Don\u2019t forget that <strong>executive sponsorship, commitment, and budget<\/strong> are some of the most critical components of a strong security compliance program. We suggest seeking these out earlier rather than later and continuing to build this bridge by highlighting risks, impact (including positive!) and your company\u2019s overall security compliance journey.<\/p>\n<p>\u200dAfter you determine your goals and identify your tooling and technology needs, it helps to know what tooling is available and what meets those needs most. Referencing industry trends and feedback can be a good place to start, as well as networking with others in the industry who are or have addressed similar challenges.\u200d<\/p>\n<h2><strong>Tips and suggestions for building your security compliance program<\/strong><\/h2>\n<p>While every team and company approaches building security compliance programs slightly differently, here are a few tips we\u2019d suggest:<\/p>\n<ul>\n<li><strong>Build repeatability: <\/strong>While it may be tempting to aim for quick wins, focus on repeatable processes and repeatable outcomes within your program. Remember that fire drills are often an indication of broken processes.<\/li>\n<li><strong>Start with a strong foundation: <\/strong>Focus on the fundamentals and do your basics well\u2014no matter how mature your program, the fundamentals always matter.<\/li>\n<li><strong>Avoid shiny object syndrome: <\/strong>Tools and technology may help, but will only exacerbate broken processes.<\/li>\n<\/ul>\n<h2>Ready to start building a strong security compliance program?<\/h2>\n<p>Check out <a href=\"https:\/\/www.vanta.com\/downloads\/uk-guide-security-compliance?utm_campaign=ToF&amp;utm_source=the-next-web&amp;utm_medium=newsletter\" target=\"_blank\" rel=\"nofollow noopener\">Vanta\u2019s guide for UK startups<\/a> to learn more about the differences and similarities between ISO 27001 and SOC 2 and which is right for your organisation. You\u2019ll also learn how to leverage compliance automation to streamline certification and support your business through an international expansion.<\/p>\n<p> <a href=\"https:\/\/thenextweb.com\/news\/everything-startups-need-to-know-about-building-a-security-compliance-program\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>With cybercrime on the rise across the UK and more SMEs being targeted, security is more important than ever before. Even if you believe your business is secure from data leaks and&#8230;<\/p>\n","protected":false},"author":1,"featured_media":13970,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=\/wp\/v2\/posts\/13969"}],"collection":[{"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=13969"}],"version-history":[{"count":0,"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=\/wp\/v2\/posts\/13969\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=\/wp\/v2\/media\/13970"}],"wp:attachment":[{"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=13969"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=13969"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.londonchiropracter.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=13969"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}