How We Made SOC 2 Compliance a Breakout Learning Success

Let’s be honest - when I first heard "SOC 2 compliance," my brain immediately thought, That sounds intense. And guess what? It was. But it was also one of the most rewarding challenges I’ve tackled. Achieving SOC 2 Type 2 wasn’t just about earning a certification - it was about proving to ourselves and our customers that we’re serious about security, efficiency, and doing things the right way.

Here’s the story of how Breakout Learning turned SOC 2 compliance into one of the best things we’ve ever done. Spoiler alert: it involved a lot of coffee, collaboration, and a few "Oh no, what now?" moments.

Step 1: Starting With a Messy Room

We kicked things off with a gap analysis. Picture walking into a cluttered room, except instead of clothes and shoes, it’s policies, workflows, and vendor agreements scattered everywhere. Our tool of choice, Drata, helped us figure out where we stood and what needed fixing.

We uncovered some critical areas to improve, including:

• Policies (some of which were gasp non-existent)
• Incident response workflows
• Vendor risk management processes

By breaking it all down into manageable pieces, we turned what seemed overwhelming into a game plan.

Step 2: Writing Policies That Don’t Put People to Sleep

I’ll be real - writing policies can be dry. But we focused on creating documents that weren’t just SOC 2-compliant; they were actually useful.

Some highlights:

• BYOD Policy: We embraced the reality that our team uses personal devices but made sure we had safeguards like encryption and access controls.
• Phishing Simulations: These are like pop quizzes for your inbox. Necessary? Yes. Fun? Not for everyone. But they worked. Our CEO, Ramit Varma, even got in on the fun with one simulation.

Key takeaway: Make your policies clear, relevant, and rooted in what your company actually does. Avoid language like "We will…" (Auditors don’t love promises - they love proofs.)

Step 3: Locking Down Security

At Breakout Learning, we store minimal Personally Identifiable Information (PII) - just email addresses - but we treated that data with the same care as more sensitive information.

Here’s what we implemented:

• Encryption at Rest and In Transit: Using AES-256 encryption with Google Cloud Platform (GCP) for storage.
• Role-Based Access Control: If you didn’t need to access the data, you didn’t get the keys.

Knowing our data footprint made it easier to stay focused and avoid over-complicating things.

Step 4: Making Compliance Part of Daily Life

SOC 2 Type 2 compliance isn’t just about passing a test - it’s a way of working. We embedded it into our operations with:

• Continuous Monitoring: Drata kept us on track and flagged potential issues before they became problems.
• Quarterly Audits: These internal reviews helped us stay proactive and prepared.
• Incident Reporting Portal: Employees could easily report and track incidents using Jira Service Management, making compliance accessible for everyone.

Step 5: Teaching the Team (and Having Fun With It)

Compliance is a team sport. We made sure everyone understood why it mattered and how they could contribute.

Here’s what we did:

• Phishing simulations (with friendly follow-ups for those who fell for it).
• Clear policy training to keep everyone on the same page.

The result? A stronger security culture where compliance felt less like a chore and more like part of our DNA.

Step 6: The Vendor Wake-Up Call

One of the biggest surprises? Finding out some vendors weren’t up to par. Think: no encryption at rest, no vulnerability assessments, and definitely no compliance certifications.

We tightened up our vendor clearance process, ensuring every partner met our standards. It wasn’t always easy, but it was worth it.

Step 7: Crossing the Finish Line

After five months of hard work, we achieved SOC 2 Type 2 certification! 🎉 It felt amazing to see the effort pay off and to know we’d set ourselves up for long-term success.

What We Learned Along the Way

1. It Takes a Village: Collaboration across teams is essential. Compliance isn’t just an IT thing - it’s a company-wide effort.
2. Automation Saves Lives (and Sanity): Tools like Zapier, Drata, Jamf, and 1Password made the process manageable.
3. Iterate and Improve: Compliance evolves, so don’t be afraid to adjust as you go.

Final Thoughts

SOC 2 compliance isn’t just about winning business (though that’s a nice perk). It’s about creating a foundation for trust, security, and operational excellence.

To anyone tackling SOC 2 (or thinking about it): It’s a challenge, but it’s worth it. And hey, if we can do it, you can too.

Have questions or a SOC 2 story to share? Let’s connect - I’d love to hear how you’re approaching it!