A digital media company operating inside a large enterprise parent faced a hard deadline: achieve SOC 2 Type 2 certification by year-end or put hundreds of thousands in customer revenue at risk. The catch was that their infrastructure was shared with the broader parent organization, making compliance boundary scoping a surgical problem most vendors could not solve. With a two-person team responsible for standing up the entire program across roughly 1,000 services, they needed a platform that could handle the complexity automatically. When the competing vendor went silent on the one technical question that mattered most, the decision made itself.
[ The Problem ]
A Hard Deadline, a Lean Team, and Infrastructure Too Tangled to Scope Manually
Customer contracts required SOC 2 Type 2 certification by December 31. This was not a strategic initiative — it was a revenue-protection requirement with a fixed end date. The engineering team responsible for delivering it had two people.
The infrastructure made everything harder. Cloud services, identity, and source control were shared with the parent organization, meaning any compliance boundary had to be drawn with precision. Scoping too broadly would entangle systems that were out of scope. Scoping too narrowly risked missing covered services entirely. A vendor that could not handle granular, tag-based AWS filtering at the account level was not a viable option — and there was no time to discover that limitation after signing.
[ What they needed ]
The team needed to accomplish all of this with two engineers and no room for manual workarounds:
- Isolate the compliance boundary from shared parent-organization infrastructure across AWS, Okta, and GitHub
- Apply resource tag-based filtering to scope AWS services without org-level access
- Automate evidence collection across approximately 1,000 services to compensate for a lean implementation team
- Establish an auditor relationship and structured readiness timeline before the year-end deadline
- Manage legacy systems outside standard automation coverage without derailing the broader program
- Navigate parent-company legal and procurement requirements without losing timeline momentum
[ Why Drata won ]
Selected over Vanta, Drata won because it answered the one technical question that determined whether the deal was even possible.
Resource tagging capability was non-negotiable, and only one vendor confirmed it: Drata's solutions engineering team provided specific, immediate answers about tag-based AWS filtering at the account level. Vanta did not respond to the same inquiry. In a compliance-mandate deal with a hard deadline, silence on a critical requirement is disqualifying — the buyer cannot afford to discover a product gap after signing.
Responsiveness signaled post-sale reliability: the buyer interpreted Vanta's silence not just as a product gap but as a preview of how support would feel under deadline pressure. Drata's immediate, specific technical engagement during the evaluation set the expectation that the same responsiveness would carry through implementation.
Pricing created a structural advantage the competitor could not match: a 50% discount tied to an investor relationship brought the annual cost to a level that made the 36-month commitment straightforward to approve internally. The buyer actively worked to protect those terms during a prolonged procurement delay, a clear signal that the commercial structure was perceived as genuinely valuable.
[ How Drata solved it ]
Drata's AWS integration supported account-level connections with resource tag-based filtering, allowing the team to draw a precise compliance boundary without requiring org-level access to the parent organization's infrastructure. Okta group-level user scoping and GitHub repo-level selection completed the isolation picture across all three critical systems.
The 1,300+ automated tests addressed the core cloud-native estate directly, reducing the manual evidence burden on a two-person team to a manageable scope. Legacy systems outside standard automation coverage were scoped for custom testing in collaboration with the audit partner, a known gap that was accepted as workable given the strength of coverage elsewhere.
Drata's Field Guide integration with the audit partner gave the team a structured readiness path they could act on immediately, not after months of preparation. When the buyer requested early platform access during a procurement delay, the team maintained momentum through direct technical engagement rather than waiting for the contract to close.
[ Before and after Drata ]
Before Drata, the compliance boundary could not be drawn without org-level infrastructure access the team did not have and could not request. The SOC 2 program existed as a deadline on a calendar with no viable execution path.
After, tag-based scoping isolated the compliance estate precisely, the audit timeline was defined and underway, and the parent organization's master agreement was structured to support expansion across additional subsidiaries.
[ Business outcome ]
With the compliance boundary defined and automation in place, the two-person team had a credible path to SOC 2 Type 2 certification before the year-end customer deadline. The revenue at risk from non-certification moved from exposed to protected, with a structured audit timeline the team could show to customers and internal stakeholders.
The parent organization's legal team ultimately executed a master agreement structured for potential reuse across other subsidiaries, signaling that the relationship extended beyond a single compliance project. A 36-month commitment reflected confidence that the platform could carry the program through initial certification and beyond, with the audit partner relationship and automated monitoring already in place for ongoing compliance.