Badges = skeptical? Green ticks = red flags? Trust has never been more polarising

Historically, startups and small-to-medium businesses (SMBs) hit a major barrier when selling their products and services to larger companies, which was their ability to demonstrate trust. Large companies traditionally expect attestation reports and/or certifications like SOC 2 and ISO 27001 before even considering buying from vendors.

A number of smart people recognised this gap between expectations. They solved this issue by creating cost-effective offerings to automate control design and evidence collection, and streamline the required audit process to assist in meeting their required trust and compliance needs. These Compliance as a Service (CaaS) vendors have now made their mark, and arguably lowered the bar, enabling scale and faster go-to-market (GTM) for these smaller companies selling to bigger players. Furthermore, enterprises are now seeing the benefit of CaaS for their own requirements, and the market has taken off.

But at what cost?

There is an increasingly louder cohort of security and audit professionals claiming we are witnessing the erosion of third party assurance, since a process like attaining SOC 2 and/or ISO 27001 typically took months to years. Now, some CaaS companies advertise they can get you there in days.

This presentation aims to address both sides of the coin, by providing context and practical guidance to the security community.

Below is a high-level outline of what the audience can expect from the presentation:

• The history behind compliance programs
• How CaaS players changed the game for smaller vendors
• Why the CaaS market has now expanded to enterprise
• Why the security community is divided on CaaS
• Why auditors, regulators and accreditation bodies need to change approaches
• Final thoughts and advice

​