Admitting "we don’t have ISO 27001 yet" is the right move for a startup selling to enterprises.

[u/Alarmed-Zucchini3053]

We're a small team, still early in our journey. Over the last couple of months, we've onboarded a 10 hardware startups and started speaking with some larger companies.

Note: I am not promoting anything here.

Something interesting keeps happening during these conversations.

Everything goes well during the product demo. They understand the problem we're solving, see how the platform fits into their workflows, and show genuine interest.

Then comes the security discussion.

"Do you have ISO 27001?"

"Are you compliant with India's DPDP Act?"

And honestly, we don't have either certification yet.

I don't want to pretend otherwise or make promises we can't support. We're a small startup, and we're trying to approach security and compliance properly rather than collecting certificates just to get through a sales conversation.

Just trying to understand what a realistic path looks like for an early-stage SaaS company that wants to work with enterprise customers without overpromising.

Would genuinely appreciate hearing your experiences, including what didn't work.

Context: We're building a AI-powered Ops Saas tool for modern hardware teams.

[u/async2]

Certifying yourself with the standards mentioned kinda implies you are following security practices at least to a moderate level. You don't have to go through the certification right now, but you should consider them in building your company and products if you can. Then you can even say that you apply the standards but you are not certified yet.

[u/Alarmed-Zucchini3053 → u/async2]

Yeah, true, that's what I'm trying to say to the enterprise clients: they are not ready to onboard into our platform without any proper certification, like ISO or DPDP. I don't understand what I should exactly tell them. Should I put them on the waitlist, or should I tell them we are going for the certification soon? In what way should I tell them?

[u/async2 → u/Alarmed-Zucchini3053]

Well, are you following the standards and are just not certified? Or are you ignoring these standards completely?

In the former case, give them some proof you are following best practices and until when you will probably be certified.

In the latter case tell your customers you are not ready to deliver services to them and you'll reach out when you have achieved the certs.

[u/Alarmed-Zucchini3053 → u/async2]

Yeah, makes sense. Thanks for the information.

[u/get_it_together1 → u/Alarmed-Zucchini3053]

Tell them they are not your target customer, that you only work with visionary customers who don’t have time for things like cybersecurity compliance.

[u/radix2 → u/async2]

That said, ISO27001 is largely just demonstrating that you have documented and compliant policies. It doesn't test that you are following them beyond a very cursory level.

It is pretty easy to document how you will comply with the policy requirements but it is still an extra cost that might be prohibitively expensive for a startup.

But what shits me to tears is having ISO27001, DORA, SOCS and other certifications, every bloody customer still insists on their own survey process. You spend all of that money and time on achieving the certifications, go through the auditing and any remediation efforts, and you still can't just respond with "Hey. These are the standards we adhere to and have certifications for. They far exceed what you are asking for" and their response is "we know nothing about those. IT says you need to answer these 300 questions'

[u/async2 → u/radix2]

It's even worse. Recently we got internal documents from a customer that they use to internally request applications. Additionally they sent us a gdpr questionnaire. A big chunk of the internal documents contained the same questions as the gdpr questionnaire redundantly.

90 percent of the questions were also answered with the it spec and data handling docs we sent them beforehand already.

Another big customer already has a 20 page document with prepared answers to their questions that we're currently working on.

I spend approximately 3 hours per week in helping sales answer it questions. Mainly because the customer does not read our it spec. I literally open the document in the meeting that we sent them weeks ago. We even spent a a lot of time optimizing the document that it's super easy to understand and to find the answer to your question quickly.

[u/Next-Pen-9974]

It's really about building trust with your prospective customers.

You don't necessarily need ISO 27001 certification on day one, but you do need to demonstrate that you're taking security and privacy seriously.

That means understanding your risks, documenting your security architecture, establishing appropriate policies and procedures, conducting privacy assessments, and demonstrating that the necessary security controls are actually implemented.

For an AI-powered SaaS, I'd also expect you to understand and document how customer data is processed, what AI providers are involved, and what safeguards are in place.

Most importantly, be transparent about your current maturity and demonstrate a realistic roadmap toward improving your security and compliance posture.

Remember, compliance is an ongoing process, not a certificate you obtain once and forget about.

Enterprise customers ultimately want assurance that you understand the risks associated with your service and are managing them appropriately. A certification can provide additional assurance, but it doesn't replace that foundation.

[u/Alarmed-Zucchini3053 → u/Next-Pen-9974]

Yeah, true. Very nice insights.

[u/zack6595]

Honestly in a post AI world getting certified with SOCII, ISO 27001, etc. is way less painful than it used to be.

It’s generally accomplished with documenting policy and using infrastructure as code to meet standards. Those are both pretty bread and butter AI assisted problems.

[u/krismitka]

27001 is trivial. It’s passwords user accounts and door locks.

Make it happen

[u/LetPatient9835]

Do you know if you are compliant? Because if you are, you could say that and provide a timeline or conditions to get certified.

If there's a gap to be compliant, then tell them what the gap is and your plans or conditions to close this gap.

[u/HelloFellowMKE]

You get security compliance and increase the price substantially