Travis Good, MD

Compliance and trust. 💪 Raising kids above the API in rural Colorado.

[Travis Good, MD @travisjgood]

Companies hire a full time CISO thinking it solves their security problem.

It doesn't. You get one person. One set of experiences. One perspective.

A fractional team gives you a group of experts that have experience with every framework, every industry, every tool.

Better coverage. Better economics. No contest.

[Travis Good, MD @travisjgood]

When should we hire a full time CISO?

At my first company, we hired a full time CISO when we were at about 40 employees. And I wish we hadn’t.

Why?

1. CISOs are expensive
2. Many CISOs lack experience with startups
3. CISOs are rarely individual contributors

Most of what a startup needs when it comes to security and compliance is security engineers or appsec engineers, and an analyst for the non-technical work. Individual contributors.

At my first company, our compliance analyst delivered tons of value. That’s what we needed. We also had at least 2 security engineers.

It’s not to say you don’t need security leadership or guidance, it’s just probably not an FTE CISO.

If I was running a SaaS startup today, I’d look at fractional support.

Specifically, I'd use @TrustWorkstreet and I'd buy @TrustVanta. It's the combination I wish I had at my first company. Solve for trust without losing focus on product, customers, and growth.

#vciso #soc2

[Travis Good, MD @travisjgood]

When I see a product with network effects, I’m jealous. An example - I’ve been loving @meetgranola and sharing Granola meeting notes. These notes are at Granola URLs so they spread the word for Granola.

Then, this week @TrustWorkstreet got 2 large company leads for pentests after the large companies got pentest reports from current Workstreet clients as a part vendor security reviews. The new leads thought the pentest reports were so good, they wanted to learn more.

3rd party risk - portals, trust pages - do have some network effects. I just didn’t expect leads from our pentest reports.

#tprm

[Travis Good, MD @travisjgood]

“How long does it take to be HIPAA compliant?”

It’s a strange question. 🤔

More accurately, how long does it take to do all the things to comply with HIPAA.

If you’re a small company, it’s def possible to be compliant with HIPAA fast, in just a few weeks. This is mostly policy and risk management work.

One caveat, in that time you likely won’t have implemented or done everything in your policies. You’ll have committed yourself to doing them at some point and cadence.

#hipaa

[Travis Good, MD @travisjgood]

There’s a lot of people talking about the loss of value and credibility of SOC 2. And a lot of blame thrown around at audit firms, the AICPA, companies that demand SOC 2 from their vendors, GRC platforms, on and on.

I always see some variation of this in the comments of these posts:

“Audit firms have reputations, and a few carry bad ones. Those in the industry know which firms these are.”

If it’s all about reputation, and we (“we” here being those in the audit and compliance industry), know what audit firms have bad reputations, what role does the AICPA have to play? Why does being AICPA accredited matter if the AICPA accredits bad firms?

I get that the AICPA manages the actual SOC framework but there’s nothing special or uniquely valuable about the framework.

[Travis Good, MD @travisjgood]

I’ve been thinking a lot about how 2025 will redefine the trust for AI vendors. We're seeing way more scrutiny for these AI vendors, this is driving demand for trust programs specifically geared towards AI.

Here's what I'm seeing:

🔍 Increased Scrutiny: buyers are demanding more from AI vendors, with a focus on ethical and responsible AI practices.

💪 Trust Programs: companies are proactively developing trust programs tailored to their AI usage.

🧓 Mature AI Management Systems (AIMS): As more companies build these programs, having a mature and audited AIMS will become a requirement.

Whether you own the models or are leveraging models from 3rd parties, now’s a good time to be thinking about building out an AIMS.

[Travis Good, MD @travisjgood]

Should you have every piece of evidence an auditor asks you for?

Not necessarily. You may have compensating controls or alternative evidence that addresses the underlying evidence the auditor is seeking. You know your company, tech, and operations best.

Don’t be afraid to ask questions, get clarifications, or push back.

[Travis Good, MD @travisjgood]

I’ve been trying to write more. I’ve also been trying to use more AI tools, both to learn but also to be more productive.

For writing, I’ve been using @superwhisper. I speak to the app and use different, heavily customized prompts to create different types of written content. I can fairly quickly “write” a few LinkedIn posts, notes to team members, follow up emails, or whatever else I want to communicate.

Superwhisper uses custom prompts with ChatGPT 4o (you can choose other models but I’ve found this one the best for me) to write a draft from my voice. Later, I look through the drafts. Some I don’t use. Others I edit and post / send / save.

I do it while I walk to and from our gym, which is in our barn (we don’t have any animals anymore). It’s an awesome ~1/2 mile walk from house to barn (that’s the pic) that clears my head.

For me, this is a good workflow.

[Travis Good, MD @travisjgood]

In Austin this week for our first Workstreet quarterly team onsite. We got a small group together to plan for Q1 and the rest of 2025.

We’ve grown to over 50 people and 100s of active customers across North America, Europe, Asia, and Latin America. And we’re planning for 2025 to be a big year!

In Austin, aside from covering a lot of internal, ops-focused stuff, I’m excited about new and expanded partners, new services, and new GTM offerings and motions:

⁉️ Security questionnaires service
☁️ Cloud Security Engineering
🧑‍🤝‍🧑 Privacy Ops
🏛️ Government / NIST / CMMC
🦙 💜 Vanta VIP and Spark Programs - new and expanded special offerings for the Vanta ecosystem to accelerate onboarding, ROI, and trust.

[Travis Good, MD @travisjgood]

Trust and compliance are changing fast thanks to a bunch of factors - regulation, risk, AI, new software like @TrustVanta, etc.

One new trend: more awareness of custom control descriptions. we’re seeing more demand from our clients to collaborate on these.

To be clear, we’ve always spent a lot of time on custom control statements. What’s new is more customers wanting to be more involved in creating them.

Why the shift? 🤔

1. [Obvious] Larger companies: We're partnering with larger mid-market and enterprise companies who have more mature trust programs They understand the importance of, and typically have the resources to create and maintain, well-written and tailored controls.

2. [Non-obvious] Auditor Pushback: Auditors are pushing for more specificity and quantifiable statements in controls.

This shift is a good thing: it feels like the whole compliance market is maturing, with the most change in SMB.

[Travis Good, MD @travisjgood]

Are you on a tight timeline for your SOC 2 or ISO 27001 audit?

👉 Book your auditor's calendar, like now.

Auditors are in high demand—especially during certain seasons.

Get an auditor early to avoid delays when you’re audit ready.

#SOC2 #ISO27001

[Travis Good, MD @travisjgood]

"Describe your logging capabilities for the applications/systems/hosts and network where Company_Name data will be posted sufficient to determine the root cause of a security incident? If so, are *these following logged, reviewed and audited?"

🦄 Company_Name = VC-backed IPO tech brand we all know.

How can questionnaires be this bad? I get language barriers but this feels like badly one-sided as companies spend tons and time and resolves filling out what seem like hastily created questions..

Companies, in both sides of this vendor review process, spend lots of money and resources on this.

[Travis Good, MD @travisjgood]

Founder: "We can't afford to slow down”

I hear this a lot when talking to companies about compliance, usually SOC 2 or ISO in this context.

Security and compliance feels like just another task on a founder or startup operator’s already overflowing plate. Nobody wants to get bogged down in procedures and lose the ability to iterate and grow. My suggestions 👇

🏋️ Right-Size Your Program: startups should tailor their compliance program to fit their size and resources. There’s endless debate on this but doing what you can do today, even if not perfect, is better than doing nothing.

👀 Spend time on policies: take time upfront shaping your commitments. This has long-term ROI.

📈 Rinse and repeat: as you grow, and add resources and risk, improve your compliance program

🤝 Find a partner: @TrustWorkstreet has helped over 500 companies right-size compliance. Don’t spin your wheels.

Trust matters. Don’t avoid it for fear of slowing down.

[Travis Good, MD @travisjgood]

I just upgraded from the Gen 3 to Gen 4 @ouraring - under 60 seconds for the process.

It doesn’t surprise me how easy it was. I’ve worn the Oura for the last 3+ years and it is far and away the best fitness / health device I’ve ever owned (and I used to write about health devices so I have a lot of experience).

I use it daily, and more the longer I’ve had it.

It’s the only device I have where the experience consistently gets better the longer I own it.

[Travis Good, MD @travisjgood]

In a crowded market where attention is hard to get, standing out is hard.

At @TrustWorkstreet, we're tweaking branding and messaging, because most of what's out there feels like the same thing over and over.

Just like the premium people now put on in-person experiences, our brand should feel memorable and resonate with what people want to see, not just what they expect to see.

We’ll wait and see where we land.

[Travis Good, MD @travisjgood]

One of the first questions I ask people about security and compliance plans, whether they’re just starting out or expanding, is:

What worries you the most about this? 🤔

At least 90% tell me their biggest fear is not having enough resources to achieve their target outcomes, be it an external audit or improving security posture (my words, not theirs).

The simple response? Tailor your compliance program to fit your company. This means aligning it with your technical and ops resources, and your budget constraints.

I often tell people “don’t overthink it”. Build a program that suits your company, market, stage, and risk. Having gone through this process at my own companies and guiding hundreds of other companies through Workstreet, I’ve learned that overthinking is the best way to stall out.

It’s not about doing everything. It’s about right-sizing the things you do to your company.

[Travis Good, MD @travisjgood]

🪲 Bug bounty programs? 🤔

Lately, I've been asked a lot about bug bounty programs.

For some of our clients, setting up and managing these programs is a no-brainer. They see it as a proactive step to find vulnerabilities.

On the flip side, other clients are skeptical to totally against them, believing that bug bounties might be scams that bring unnecessary risk and liability.

In some cases I’ve seen, programs are a "CYA" only to document and handle reported bugs diligently

Are bug bounties a thing you need, maybe at a certain scale, or do you avoid them?

#BugBounty

[Travis Good, MD @travisjgood]

“Are you an MSP or a vCISO?”

I got asked this on a call this week, and it’s a fair question.

Many MSPs are expanding from managing software and IT to providing security and compliance services, now offering vCISO services. On the flip side, some vCISOs, like us @ @TrustWorkstreet, use the term “MSP” because it resonates with our clients and partners.

In reality, we're all converging to some extent.

The biggest difference, at least for a good vCISO, is a first-principles approach to building client trust.

#trust #vciso #msp

[Travis Good, MD @travisjgood]

🎉 Exciting stuff at @TrustWorkstreet as we kick off 2025!

In just the first week back, we’ve got a lot going on.

🌐 Ecosystem Alignment: our goal is product partner fit. Collaborating closely with the rapidly maturing @TrustVanta ecosystem, we're aligning our network of partners to enhance our services and make it easier for our clients to solve the JTBD of building and maintaining trust.

🚀 Customer Success: we’ve started building out customer success as a function – defining the customer journey and building the tracking and reporting we need.

🔄 Optimizing our funnel: overhauling our CRM and streamlining our contracting to improve conversion through our funnel. RevOps is fun!

🧑‍💼 Team Scaling: we’re growing! We're hiring across various functions.

📈 Going Upmarket: supporting mid-market and small enterprises as we expand our services in security, compliance, and trust.

⚙️ Tech Efficiency: Building internal tech (data, AI, agents) to elevate client and delivery experiences.

🆕 New Service Areas: a few areas where we’re looking to expand what we’re already doing;
- Cloud Security Engineering and SecOps
- Security Questionnaires & Third-party trust optimization
- CMMC and more NIST offerings

🚦 That’s a lot: we have a few other things but I’ve got to get back to a few client security questionnaires. Excited to share more updates and insights as we progress.

#Cybersecurity #Compliance #Workstreet #soc2 #cmmc

[Travis Good, MD @travisjgood]

“Is there potential for reputational impact to our institution due to the nature of this product/service?”

As a SaaS company answering this for a potential customer, that’s hard to answer. The way it’s worded, is the answer ever “no”?