The uncomfortable truth about early-stage security
Here is what nobody tells you when you start building a security program: the frameworks are not the hard part. ISO 27001 has 93 controls. SOC 2 has five trust service criteria. NIST CSF fits on a poster. The taxonomy is well-documented. The hard part is sequencing — knowing what to do first when everything feels urgent, your team is small, and your customers are already asking for your SOC 2 report.
Most security guidance is written for organisations that already have a CISO, a GRC team, and a budget. If that describes you, this article is not for you. This is for the founder, the first security hire, or the engineering lead who just got handed the compliance mandate alongside their existing responsibilities.
Start with assets, not frameworks
The instinct is to pick a framework and start checking boxes. Resist it.
Every meaningful security decision flows from one question: what are we protecting? Before you open Annex A or read a single SOC 2 criterion, build an asset inventory. This does not need to be exhaustive on day one. Start with three categories:
Data stores. Where does customer data live? Production databases, backups, analytics warehouses, third-party SaaS tools that ingest your data. Map each one. Note the classification — is it PII, financial data, health data, or business-sensitive?
Infrastructure. Cloud accounts, CI/CD pipelines, DNS, identity providers, monitoring systems. These are the systems that, if compromised, give an attacker access to everything else.
People and access. Who has access to what? How do they authenticate? Where are the service accounts? This is almost always messier than anyone expects.
This inventory becomes the foundation of everything that follows. Your risk register, your access controls, your incident response plan — all of them reference this map. Build it first.
The first 90 days: three things that matter
With your asset inventory in hand, focus on three workstreams in your first quarter. Not thirteen. Three.
1. Access controls and identity
This is the highest-leverage security investment you can make. A startling number of breaches trace back to compromised credentials, overprivileged accounts, or orphaned access.
Enforce multi-factor authentication everywhere. Not just your cloud console — your identity provider, your version control, your CI/CD platform. Use SSO where possible so you have a single pane to manage access.
Implement least privilege. Engineers do not need production database access for daily work. Executives do not need admin rights to the cloud console. Audit who has access to what, and remove anything that is not actively needed.
This alone — MFA plus least privilege — eliminates entire categories of risk. It is boring. It is not glamorous. It is the single most impactful thing you can do.
2. A living risk register
A risk register is not a compliance artifact. It is a decision-making tool. Start one immediately, and keep it simple.
For each risk, capture five things: what the risk is, what asset it threatens, how likely it is, how severe the impact would be, and what you are doing about it. That last column — the treatment — is where the real work happens. For each risk, you are either mitigating it (reducing likelihood or impact), accepting it (consciously deciding the cost of mitigation exceeds the risk), transferring it (insurance, contractual indemnification), or avoiding it (stopping the activity that creates the risk).
Review this register monthly. Not quarterly, not annually. Monthly. Risks change as your product evolves, your team grows, and your infrastructure shifts. A risk register that is reviewed once a year is not a risk register — it is a historical document.
3. Incident response basics
You do not need a 40-page incident response plan on day one. You need answers to four questions:
- How do we detect that something is wrong? (Monitoring, alerting, logging)
- Who do we call when we detect it? (Roles, escalation path, communication channels)
- How do we contain and investigate? (Runbooks for common scenarios — compromised credentials, data exposure, service outage)
- How do we notify affected parties? (Customer communication templates, regulatory notification timelines)
Write these down. Store them somewhere accessible — not buried in a Confluence page that nobody can find during an actual incident. Run a tabletop exercise in your first quarter. It does not need to be elaborate. Walk through a scenario as a team. You will immediately discover gaps in your plan that no amount of documentation review would reveal.
Choosing your first framework
Once you have the fundamentals in place, it is time to align with a framework. The choice depends on your market, your customers, and your growth trajectory.
SOC 2 is the de facto standard for B2B SaaS in North America. If your customers are asking for a trust report, this is likely where you start. It is flexible — the trust service criteria are principle-based rather than prescriptive — which means you have latitude in how you satisfy them.
ISO 27001 carries more weight internationally and is increasingly expected by enterprise buyers globally. It is more structured than SOC 2, with a formal certification process and mandatory management review cycles. If you are selling into Europe, APAC, or regulated industries, this may be your first move.
Both is increasingly the answer for companies that sell to a diverse customer base. The overlap between SOC 2 and ISO 27001 is substantial — roughly 70% of the controls map to each other. If you design your program around the union of both frameworks from the start, the incremental effort for the second certification is manageable.
The key insight: do not build your program for the framework. Build a good security program, then map it to the framework. The distinction matters. Framework-driven programs produce compliance artifacts. Security-driven programs produce actual risk reduction — and the compliance artifacts come along for free.
Evidence collection is the silent killer
The most underestimated aspect of running a security program is evidence collection. Frameworks require proof that your controls are not just designed but operating effectively. That means screenshots, logs, configuration exports, policy acknowledgment records, training completion certificates, access review documentation — the list is long, and it compounds over time.
If you are collecting evidence manually — taking screenshots, exporting CSVs, copying logs into shared drives — you will spend an unreasonable percentage of your time on clerical work. This is the compliance treadmill that burns out security teams and turns audits into fire drills.
Automate evidence collection from day one. Connect your cloud infrastructure, identity provider, version control, and project management tools to your GRC platform. Let the system pull configuration evidence continuously rather than scrambling to assemble it before an audit window.
This is not about convenience. It is about accuracy. Manually collected evidence is a point-in-time snapshot. Automated evidence is continuous. The difference between "we were compliant when we took this screenshot" and "we have been compliant every day for the past year" is the difference between checkbox compliance and genuine security assurance.
The compounding effect
Security programs exhibit strong compounding returns. The asset inventory you build in month one informs every risk assessment for years. The access control policies you establish early become organisational muscle memory. The incident response plan you draft and rehearse becomes faster and more effective with each iteration.
The organisations that build security programs well are not the ones with the biggest budgets. They are the ones that start with the right foundations, sequence their efforts intelligently, and treat security as an ongoing practice rather than a project with a finish line.
Start with assets. Lock down access. Build a living risk register. Plan for incidents. Choose a framework that fits your market. Automate evidence collection. And review, iterate, and improve — continuously.
The audit will come. When it does, you will be ready. Not because you crammed, but because you built something real.