In the last two years, the Israeli startup scene has changed. It is now possible to obtain unicorn status by rapidly developing new products, reaching significant sales, and raising money to scale up the process. Startups gain a greater degree of prestige when this is achieved quickly.

In order to achieve this, companies must alleviate the burden of compliance.  However, there must be a balance between compliance and business processes to move fast, be secure, build customer trust, and sell more. That is why many American companies require SOC 2 compliance as a prerequisite prior to entering the market. It is for this reason that Israeli startups struggle to penetrate the U.S. market.

Compliance can be an obstacle to rapid growth and closing deals

Any delay after the stealth and product development maturity phases can be expensive, which may hinder growth and revenue targets. Increasing the pace of revenue and development for a startup requires funding, manpower, and removing barriers, such as regulatory compliance and global information security standards. Although it is unusual for venture capital funds to consider compliance as part of their due diligence, they do require significant sales and an increase in ARR above $100,000 as a prerequisite to Round A funding. This is consequential as they may withdraw from the investment without it and work under the assumption that the product is based on a fast scale. Companies cannot reach major sales without compliance since clients expect compliance before purchasing a product. Essentially, without compliance, there will be no investment.

So, what can startups with limited resources do if they are unable to absorb the regulatory requirements of American corporations?

In the early stages of a company, the founders and management are also required to perform sizable and administrative tasks to meet the same standards and regulations. The implementation of controls and compliance can take about 250 hours a year for the startup (if there is one framework). Based on my experience, every time a professional development team isn't focused on technology, it can become costly for an organization, and depending on the accounting and economic constraints, the regulatory practices can be a bottleneck for the entire organization due to the hourly cost.

Ordinarily, startups assign their CTO to manage the project, forcing them to devote many hours to conducting audits, which of course takes them away from their main objective of developing the product. For startups with limited resources, automated compliance becomes a necessity.

I recently encountered a case involving a company that had global contractors working with sensitive information. Since these contractors were not considered the same as ‘employees,’ they were unaccounted for in the audit process, which rendered the compliance process ineffective. Additionally, the fact that controls were not tested in this case also contributed to an ineffective compliance process.

Such compliance or regulatory issues increase risk and lower the trust of current and future customers.

What are the basic steps to selling to large organizations?

Can your product pass SOC 2?

• This can be easily tested through conversations with industry insiders and prospects. SaaS products sold in the U.S. are required to comply with this standard. The more the solution correlates with the organization's core systems, the more imperative it is for the organization to comply.
• In the case where your company must meet compliance and standard requirements, you should identify a partner who can advise you on how you can save significant time and resources, shorten the readiness assessment process, and achieve good results and reviews in a short time.
• Adhering to the SOC 2 standard can seem daunting for an organization. It is imperative for organizations to understand the relevant factors in advance with regards to the organization itself (product managers, support staff, HR, IT, etc.), the hours they will spend (both the audit and preparation), the other tools the company will need to implement (the time and cost planning involved), and lastly understanding the direction from beginning to end.

Writing work procedures for compliance

• Management must build defined and organized work processes and organizational policies in advance. Some of these include writing code with changes, managing permissions, and managing approaches. Documents must not only comply with compliance and standardization processes, but should also serve as an organization's knowledge base, reflecting the minds of management towards all employees, preserving organizational knowledge, and helping the company succeed.
• There are also compliance tests. This is an annual test in which the effectiveness of the controls is evaluated. It is critical for you to understand how to easily integrate and monitor technical and process controls. This includes centralized management of compliance and information security activities, automation of everything, and maximizing management and relevant factors that are critical to project success.
• If you have decided to go through a compliance process, and you are willing to invest the time and money, do it right and maximize your ROI. Rather than looking at the compliance and standardization processes as a checklist, understand what the organization can gain from proper characterization and implementation, which will support rapid growth, passing of information security reviews and calculated risk management. As your company grows, you will have to meet more standards and regulations.

So, what's next?

While geographical region or country often determined which regulation a company must comply with in the past, today this has evolved into industries such as Healthcare and Payments like HIPAA and PCI-DSS standards. In the not-too-distant future, we are likely to see standards and regulations that apply to innovative technologies like blockchain, artificial intelligence, autonomous vehicles, the Internet of Things and more.

As technology develops, RegTech processes will become smarter, and more accurate with the purpose of ensuring growth by advancing organizational processes that will support the information security strategy and build trust in the corporate supply chain.

Written by Meiran Galis Co-Founder and CEO of Scytale