Sell & Scale at Okta was a highlight of Day 2 at SF Tech Week. I had the opportunity to speak with Amy Johanek and Greg Hall about selling to government and working toward that first contract.
Greg discussed SOC 2, ISO 27001 and ISO 42001, highlighting the importance of understanding compliance when pursuing federal and government projects.
Understand the buying context
My starting question is what the buyer actually needs in order to evaluate the product. A conversation about government opportunities is a reason to learn the procurement context before deciding which evidence to prepare.
Scope compliance to the opportunity
The relevant requirements depend on the buyer, contract, data and intended use. Mentioning SOC 2 or an ISO standard in a discussion does not establish that every government contract requires it. Founders should check the actual opportunity and its requirements.
Use the terms accurately
SOC 2 refers to an attestation report about controls. ISO/IEC 27001 concerns an information security management system, and ISO/IEC 42001 concerns an AI management system. These are distinct forms of assurance and management, rather than interchangeable badges.
Prepare early enough to answer well
The discussion connects with our work at Truva helping startups with SOC 2 readiness and audit preparation. My takeaway is to identify the relevant requirement early, understand the work behind it and prepare evidence that addresses the buyer’s questions.
My takeaway
Start with the actual buyer and contract. Build a preparation plan around their requirements instead of assuming that the same list applies to every opportunity.
Thank you, Amy and Greg, for a great discussion.
Questions from this recap
Are SOC 2 and ISO standards required for every government contract?
No universal requirement is established by this discussion. The actual buyer and contract determine which requirements apply.
What did I take from Sell and Scale?
Understand the relevant requirements early when pursuing that first government contract, and connect compliance preparation to the real opportunity.
Explore further
Which buyer requirement would be hardest for your startup to demonstrate today?