They told us to get an "information security audit" — what is it, and is it really necessary?

The auditing firm will request repository access, server logs, and network topology diagrams. In your code, they'll check how sensitive data is encrypted; on servers, they'll inspect where SSH keys and database credentials are stored. Having these organized in advance will speed up the process significantly.

Don't sign with an expensive auditing firm right away. Ask the client's IT director directly: "Would a standard penetration test report and a remediation roadmap suffice?" In most cases, they aren't looking for a massive organizational audit, just proof that your platform can't be easily breached.

We paid 400,000 RUB to get one done last year. The auditor found 9 vulnerabilities, 2 of which were critical. It took us 10 days to patch them, and then we got a clean report. The client signed a 3-year contract the very next day because of that report—it paid for itself many times over.

There are firms charging 150k rubles that just run an automated vulnerability scanner and export a PDF. Don't fall for that; the enterprise's security team will spot a superficial report instantly, and your company's credibility will be shot.

Enterprise companies face severe legal and financial penalties for data breaches originating from their supply chain. Demanding an audit report is standard procurement policy under their third-party risk management framework.

There are 3 main things the visiting audit team will ask for: 1) Penetration testing findings for the servers, 2) Employee access logs to internal company data and mandatory two-factor authentication, 3) A recovery plan showing how often and where the data is backed up.

A 400 thousand audit cost is definitely worth it for a 14 million deal; this isn't an obstacle, it's your ticket to the enterprise league.

I've been dealing with this for a long time. If you get three different answers on a topic, the question was asked wrong.

If you post the result here, it will help others too.

The answer above hits the nail on the head. When we decide without measuring, we always end up in the same place.

Just leaving this note, it might be useful.

I have a question, don't want to go off-topic though. If you scold false alarms, nobody will report again.

If you post the result here, it will help others too.

Good call starting this thread. If it's your first time start small; scaling comes later.

The answer varies greatly by industry; there is no one-size-fits-all rule. If you post the result here, it will help others too.

I agree. If permission and scope aren't in writing, don't start that test.

That's all, sorry if I went on too long.

I feel the same way. An automated scan report is not the same as a penetration test.

If you post the result here it will help others too.

I feel the same way. If it's your first time, start small; scaling comes later.

If you post the result here, it will help others too.

I feel the same way. If 2FA is on, a stolen password alone is useless.

An automated scan report is not the same as a penetration test. That's all, sorry if I went on too long.

The opposite happened to me, that's why I'm writing... tbh most incidents start with a leaked password, not a vulnerability.

I'm also curious if anyone does it differently.

Exactly like that. btw when you try to change everything at once, nothing settles.

Good luck with that.

i feel the same way and solutions that work at a small scale collapse when you grow; I learned this late.