I would wonder if there is a heuristic where you don't need a specialized and mature security governance program until you are close to or have established PMF. Security <i>is</i> tech governance, so you need something to govern before you drop in a bunch of security people.<p>If you have an enterprise product, either you get the ISO cert, or give up some of your sales margin and leverage to be a "partner," to another vendor who does. e.g. If you are selling to a bank and you don't have it, it's likely the bank may ask a consultant from one of the big firms to "recommend," your product as part of an engagement, and the compliance risk nominally shifts onto them, which is super not-cheap. I'd start discussions with VaRs and consulting firms about partnering now in case you get a demand for it, just to be hedged.<p>However, as a security pro, I would almost never suggest it to a startup until they are much later stage, like B and C rounds, or above say, $20m ARR, and perhaps not even then. The reason for this is if you are still establishing PMF, ISO is an expensive distraction, same with FedRAMP. Pay for it out of profits only, or tack on the expense to a customer contract, as imo, it's a waste of precious runway.<p>Strategically, I think it's worth considering taking the revenue hit of partnering with a VaR or a big-N consulting firm early to grow your channel first, and who specializes in managing these dead weight regulatory burdens while you focus on building a product that grows fast enough that you can choose solve ISO yourself as an optimization problem later on when you are rolling in cash, and not as a strategic barrier. I'd venture that the lack of an ISO cert is not going to get in the way of an exit or early stage growth. It's an expense that I would punt to whoever acquires you. If you are acquiring companies, then maybe you're big enough to consider it.