Compliance as a Growth Accelerator | Blog by anecdotes

As cloud-first companies reach new growth milestones, they come face to face with an abundance of exciting and fresh opportunities—new investors, new hires, evolving business deals, and, if all goes well, the prospect of a very successful future.

But along with this tremendous growth comes new challenges and uncharted territories that companies have yet to navigate. And these challenges become more complex and nuanced as they expand. Infosecurity, and new Compliance requirements in particular, can prove to be thorny—quickly changing from what was previously an afterthought to a daunting, time-sucking source of friction between Compliance teams and their stakeholders during hyper-growth stages.

When “Good Enough” Just Isn’t

It has become increasingly important for companies to meet Compliance standards set forth across industries today. System and Organization Control 2 (or SOC 2) for instance, has become important for companies that work in the cloud. Collecting, storing, and sharing a plethora of customer data, the completion of a SOC 2 audit assures customers and various stakeholders that the proper infrastructure and processes are in place to protect information from unauthorized access. The same goes for the ISO 27001 framework, which documents proper handling of information security, HIPAA to protect medical records, and Sarbanes-Oxley (SOX) to increase transparency in financial reporting.

While meeting Compliance requirements like these can be challenging at any stage, in the new hyper-growth phase, meeting and maintaining new Compliance frameworks becomes more critical—and more challenging—than ever before. The “good enough” methodologies employed by small startups suddenly no longer work. And considering that the infrastructures of hyper-growth companies are nothing short of labyrinthine mayhem—with massive increases in usage of third-party SaaS tools, containers, virtual machines, and security, developer, sales/marketing, and HR solutions—it’s nearly impossible to successfully navigate Compliance activities and processes for all these systems in the manual fashion currently used by the majority of businesses.

Additionally, the ad hoc fly-by-the-seat-of-your-pants approach that may have previously aided one SOC 2 report here or perhaps another ISO 27001 certification there now fails to provide the groundwork that would enable teams to leverage already-performed work for upcoming audits. A siloed strategy therefore leads to the need for repeat compliance activities, wasting precious time and valuable resources. For example, in the “one-time-project” mindset, evidence for similar controls in different frameworks must be collected multiple times, causing the people tasked with the chore to perform duplicate work. Additionally in this stage, more is needed at all levels—more frameworks, more controls, more evidence, more SaaS tools and cloud environments, and better overall security and compliance maturity–all of which are difficult to account for in a one-time-project model.
‍

And thus, the current state of Security Compliance at hyper-growth companies relying on these tactics today: a hot mess of outdated and manual, human-driven activities and processes, all of which further burden already overburdened security teams. In fact, today’s manual methods are reminiscent of pre-cloud days, featuring screenshots, Excel spreadsheets, and face-to-face meetings. Without automation of processes, no single source-of-Compliance-truth, and no end-to-end visibility, these manual and old-school techniques not only lead to damaging errors, audit fatigue, and wasted resources—they hinder the ability to sustain impactful growth, prevent Compliance from being used to bolster security posture, and limit a company’s potential to effectively scale against competition.

Compliance-as-a-growth-accelerator (CaaGA)

To make it through the trials that come with remaining compliant during hyper-growth phases, companies need to rethink their model. This means accepting a new perspective, looking at what Compliance can do for their business, and how it can be used strategically instead of only serving as a pesky formality.

By taking a Compliance-as-a-Growth-Accelerator Approach (CaaGA), companies can build mature compliance programs that establish connective tissue between frameworks and effort. With a panoramic, 360-degree perspective, Compliance can become a way to sustain dynamic growth instead of a tedious, dreaded roadblock.

What Does This New Perspective Look Like?

The Compliance-as-a-Growth Accelerator approach is all about reshaping Compliance as a catalyst to enhance and drive growth. Specifically, this new model:

• Takes the efforts done for each framework and applies that extracted information seamlessly and in the background to further frameworks, drastically reducing time and energy expended. It also establishes an underlying fabric with which Compliance posture can be monitored and understood, and provides a centralized hub to remediate issues at scale so that control posture can be continuously maintained.
  

• Provides the right controls and measures, to meet current business and/or product needs, as well as any future requirements. By anticipating additions and changes to the business and product roadmaps, Compliance controls can be added incrementally and then cross-mapped to meet these new frameworks seamlessly.
  

• Facilitates seamless adjustments to new policies and regulations, whether due to a new use case that now requires HIPAA compliance, the need to become compliant with SOX in case of an IPO, or the need to add on SOC 2/ISO 27001 to enter into a new market.
  

• Anticipates a rapidly evolving tech stack. Many Compliance approaches use a prescriptive model, one that assumes a company’s tech stack is relatively limited. While this can work for young startups, which typically use a similar and narrow group of tools and platforms, it’s not the right fit for hyper-growth companies whose tech stack is constantly evolving and becoming more varied and unpredictable.
  

By adopting a CaaGA approach, Compliance is no longer an enemy. Instead, it becomes a trusted ally that supports the organization and provides guidelines for Compliance and security maturity.

Leveraging Compliance as a Way to Succeed

The hyper-growth landscape is on fire today; the funding taking place at cloud-first companies is constantly breaking new records and the number of companies looking to go IPO grows with each month. Through a Compliance-as-a-Growth-Accelerator perspective, companies can expand faster, capture greater market share, earn more credibility, and leverage Compliance as a way to succeed in today's competitive landscape.

‍

This article was originally posted on builtin.com