<story><title>Minimum Viable Secure Product</title><url>https://mvsp.dev/</url></story><parent_chain></parent_chain><comment><author>tptacek</author><text>If you broke the practice of securing a company into software security, network&amp;#x2F;platform security, and corpsec, I think the proper prioritization from an engineering perspective would be corpsec &amp;gt; software security &amp;gt; network&amp;#x2F;platform security.&lt;p&gt;Thankfully, this checklist doesn&amp;#x27;t lead startups into a quagmire of stupid network security tools, scanners, and assessments. But it also leaves out corpsec almost completely (&amp;quot;single signon&amp;quot; is an application security control in the checklist, which &lt;i&gt;wildly&lt;/i&gt; misses the point), so we&amp;#x27;ll call that a wash.&lt;p&gt;What I&amp;#x27;ll say is that if you&amp;#x27;re concerned about closing deals and filling out checklists, the appsec controls here aren&amp;#x27;t going to move the dials much for you, and the corpsec stuff that it&amp;#x27;s missing is going to trip you up. I&amp;#x27;m not in love with it.&lt;p&gt;Also: for most companies, you&amp;#x27;re going to want to be well past product-market fit before you start engaging consultants to assess your code. Most startups are well past 30 engineers before they have their first serious assessment. Crappy assessments can hurt as much as they help, and they&amp;#x27;re the kind you get if you&amp;#x27;re shopping for $5k-10k pentests while delivering with 5 engineers.</text></comment>
<story><title>Minimum Viable Secure Product</title><url>https://mvsp.dev/</url></story><parent_chain></parent_chain><comment><author>lmeyerov</author><text>I dislike any compliance document that requires paid &amp;amp; external vendors, so would love to see that factored out&lt;p&gt;SOC I vs SOC II helps get at these kinds of distinctions in practice. I&amp;#x27;ve seen a lot of conversations enabled by that. &amp;quot;We did the SOC I software checklist. At some point, we&amp;#x27;ll pay vendors $50K-250K for SOC II, feel free to fast track that now as part of our contract.&amp;quot;&lt;p&gt;I get why it&amp;#x27;s there, but this kind of thing is also why, despite being designed to address a real need, initiatives like FedRAMP have been slow &amp;amp; expensive disasters in practice. We should be pushing to self-serve &amp;amp; automated accreditation, and all the way to 1 person projects. Anything that puts third parties, people, and $$$ in the critical path needs to be split out.</text></comment>