Anna: We keep saying "we'll sort compliance after launch" but the enterprise pilot is already asking for controls.
Greg: Exactly why this session exists—let's map what "good enough" looks like so we stop sprinting blind.
Anna: Enterprise pilots and contracts die quickly when you can't evidence basic compliance hygiene. Not because the company is careless, but because the buyer's process has nowhere to put you.
Greg: And regulators and investors are looking for documented intent, even when your stack is still shared logins and duct tape.
Anna: That's the part founders underestimate. Nobody expects maturity at twenty people. They expect you to know where you stand.
Greg: Getting ahead of it keeps trust with the customers handing you sensitive data, without stopping engineers from shipping.
Anna: SOC 2 feels mythical—people say it takes years and a room full of consultants.
Greg: Type I can land in a quarter if we assign an owner, reuse templates and rehearse evidence pulls monthly.
Anna: And Type II?
Greg: Plan on nine months because auditors watch controls run; automation for access reviews and logging keeps it sane.
Anna: Start with one owner. Usually a COO, a security lead or a fractional CISO, plus a project manager or chief of staff to chase the detail.
Greg: The tooling can stay light. A ticket queue for control tasks, password manager exports, device management screenshots, change logs.
Anna: The habit that matters most is rehearsing evidence pulls monthly, so nothing important lives only in someone's inbox or head.
Greg: And automate early where you can: cloud posture tools, syncing your HR system to your identity provider, log retention policies.
Anna: Automate before the gap list grows, because retrofitting evidence is the expensive part.
Anna: We're pulling in GPL, Apache and MIT libraries without thinking—what's the real risk?
Greg: Licences travel with your code; at minimum we owe attribution, and GPL triggers source disclosures if our product distributes binaries.
Anna: So we need a log of what we're using?
Greg: Yes, a lightweight SBOM and approval step keep surprises out of vendor questionnaires and customer audits.
Anna: Our product team wants to ship a new analytics feature tomorrow—privacy review feels like a blocker.
Greg: Run the 15-minute DPIA template, strip optional personal fields and document consent flows now; it's faster than rewriting code post-incident.
Anna: Do we loop legal in on every tweak?
Greg: Bring them in for cross-border data moves or sensitive categories, but empower squads with reusable checklists for the routine cases.
Anna: Who actually owns this when we're only twenty people?
Greg: A fractional CISO or ops lead can captain it, with a privacy counsel on retainer and an engineer automating the evidence pulls.
Anna: What's the growth path for someone who loves this work?
Greg: Start as compliance coordinator, step into trust and safety leadership, and grow toward head of risk once the company scales.
Anna: Five things to put in place. Appoint one compliance captain, and document who covers for them.
Greg: Centralise the policies, risk registers, privacy impact assessments and software bills of materials in a shared drive or GRC tool, with version control.
Anna: Schedule quarterly control walkthroughs with engineering, product and legal in the room together.
Greg: Budget for at least one external readiness review a year, before the real audit rather than during it.
Anna: And name the small wins, a closed policy gap, an automated access review, so the team reads compliance as progress rather than drag.