A 20-person APAC security-services company hired a new security leader and found a greenfield compliance environment. For a firm that sells security to its own customers, the absence of SOC 2 or ISO 27001 was not just an operational gap — it was a direct constraint on revenue and credibility. The new security leader knew exactly what platform he wanted. The challenge was not the technology. It was building a case that could survive a mandatory three-vendor procurement review while two competitors raced to undercut the price.
[ The Problem ]
A Security Company With No Compliance Program — and Customers Who Were Starting to Notice
When new security leadership arrived, they inherited a compliance environment with material gaps relative to what customers expect from a security-services provider. There were no established controls, no audit history, and no path to the certifications that US market expansion and enterprise customer conversations would require.
The roadmap was ambitious: SOC 2 Type I within six months, followed by Type II, ISO 27001, and Essential Eight. Every month without a program in motion was a month of commercial exposure. The team needed a platform they could build on for years, not a tool that would need to be replaced when the framework list grew.
[ What they needed ]
The security leader needed to accomplish several things at once:
- Establish a compliance program from scratch in a hybrid cloud and on-prem environment
- Achieve SOC 2 Type I within approximately six months of starting
- Build toward ISO 27001, Essential Eight, and a longer-term NIST and IRAP roadmap
- Integrate continuous evidence collection across AWS, Azure AD, GitHub, Jira, and CrowdStrike
- Evaluate and defend a platform choice against competing vendor quotes in a formal procurement process
- Secure renewal pricing terms that would not erode the value of the initial investment in Year 2
[ Why Drata won ]
Selected over Vanta, the security leader's direct experience running Drata in a prior role made the platform choice defensible in a mandatory three-vendor procurement process where Vanta discounted aggressively the moment it learned Drata was involved.
Prior production experience: the security leader had operated Drata at a previous company. That history meant he could scope the implementation, anticipate the control-build timeline, and make a credible internal recommendation — none of which a trial or demo could replicate for a 20-person team with no compliance baseline.
Audit-partner alignment: the managed service partner was already positioned as the likely audit firm, and a compliance-specialist implementation partner provided a ready path from contract to audit-ready. Vanta's discount could not replicate that ecosystem in the same procurement window.
Pricing that held up in a three-vendor file: Vanta cut its price significantly after learning Drata was in the deal. Drata met the security leader's target price and added a Year 2 renewal cap, giving him a package he could take to finance without the deal looking like a premium choice against two cheaper alternatives.
Framework depth for a long-term roadmap: the security leader was not buying for one audit. The roadmap ran through SOC 2, ISO 27001, Essential Eight, NIST, and eventually IRAP and FedRAMP. Drata's native coverage and custom framework capability meant the platform would not need to be replaced as the program matured.
[ How Drata solved it ]
Drata GRC gave the security leader a platform he had already operated in a prior role, which meant onboarding time went into building controls rather than learning a new tool. Native framework coverage for SOC 2, ISO 27001, and Essential Eight matched the immediate roadmap, and AI-assisted custom framework mapping provided a path to DISP and PSPF as the program matured.
Integrations with AWS, Azure AD, GitHub, Bitbucket, Jira, and CrowdStrike enabled continuous evidence collection across the company's cloud environment from day one. Drata TPRM and risk management were included at the Enterprise tier, giving the team room to expand vendor oversight as the supplier base grew. A demo of Compliance as Code showed how codebase monitoring could complement existing shift-left tooling without replacing it.
The Trust Center addressed the inbound security questionnaire burden the team would face as customer conversations scaled. Paired with an implementation path through a compliance-specialist partner, the platform offered a structured route from greenfield to audit-ready without requiring the team to build the program architecture themselves.
[ Before and after Drata ]
Before Drata, the company had no compliance program, no audit history, and no certification timeline to show customers or prospects. After, a SOC 2 Type I audit path is defined and underway, with a six-month target that the team can communicate externally and a platform built to carry the program through a multi-year framework roadmap.
[ Business outcome ]
The security leader closed the evaluation in 25 days and pulled the contract signing forward twice as commercial terms came together. A SOC 2 Type I audit path is now underway, with a target of certification within six months — a timeline the team can show to customers and prospects today.
The compliance program is being built on a platform designed to carry the company through SOC 2 Type II, ISO 27001, Essential Eight, and eventually IRAP and FedRAMP, so the investment does not need to be revisited as the framework roadmap expands. US market expansion conversations, previously constrained by the absence of any certification, now have a credible timeline behind them.