Insights and expertise from Thoropass

23 NYCRR 500: What Startups Need to Know

If you are (or are working with) a financial institution operating in New York, listen up.The New York Department of Financial Services (NYDFS) recently introduced 23 NYCRR 500, legislation that defines how financial companies protect sensitive consumer information. And, chances are, you need to comply with it—for good reason: cybersecurity matters now more than ever.

We’ve Raised a Series A!

Does My Startup Need a HIPAA Business Associate Agreement?

Health care companies take on a significant amount of risk when they manage patient information. They have to comply with strict federal rules, and working with those rules often means shouldering some of that regulatory burden.

Everything You Need to Know to Get SOC 2 Compliance for Your Startup

Chances are your startup will need SOC 2 compliance to close enterprise deals and move upmarket. Also likely — you have no idea where to begin. Becoming SOC 2 compliant isn’t an easy feat. It takes significant time, effort, and resources to get that first clean report. What’s more, it seems like the bulk of SOC 2 resources are meant for larger, more traditional companies. So, what’s a startup to do?

A Founder’s Guide to Deciphering the Right Compliance Framework for Your Startup

It doesn’t seem like compliance frameworks are meant to be understood by busy founders or even mere mortals. For example, take a look at the excerpt (right) from an AICPA guide on SOC 2. Not exactly bedtime reading.