Context
Enterprise customers asked for security proof before they would sign. The security review was blocking the sales roadmap.
Constraint
A penetration test had left 22 findings, and the team had neither the time nor the context to work through them while shipping product.
Decisions
- Scoped the SOC 2 readiness program first, so the work aimed at what an auditor and an enterprise buyer would actually ask for.
- Triaged the 22 findings by real risk instead of by how alarming they read, then fixed them in that order across staging and production.
- Set up credential rotation procedures and a repeatable way to collect audit evidence: access reviews, policies people follow, logging you can point at.
Result
- All 22 findings were remediated across staging and production.
- The company has audit evidence ready, and its sales team can answer security questionnaires without stalling the deal.
- Compliance stopped blocking the roadmap and started unblocking it.