Minimum Viable Secure Product
I think a lot of comments here might be missing the point of this standard - it’s not specifically designed just for startups or to cover general organisation security (like EDR). It’s a product feature oriented checklist that should help short circuit some aspects of supplier security due diligence and establish a set of product security features that any B2B product with ambitions to sell to enterprise customers would benefit from aspiring to, and anyone buying can leverage. That means large multi-product businesses looking to ship an MVP for a new service as well startups with a bright idea but a possibly limited understanding of enterprise IT compliance needs.<p>I’ve got some experience as Head of Cyber&#x2F;InfoSec at a couple of startups&#x2F;scaleups and I see this as potentially useful in a bunch of ways if broadly adopted. It establishes a baseline both for our own products and our suppliers, attests to stuff that actually affects how we integrate with and operate a third party product (ISO 27001 gives me no clue whether you support SSO, have viable logs that I can actually ship to the SIEM etc.) and hopefully simplifies both the due diligence we do on our suppliers as well as that done on us by our customers by allowing us to reduce a good chunk of the product feature questions to “does your product meet the MVSP standard”.<p>There was a pretty useful discussion of it on the Google Cloud Security podcast a while ago: <a href="https:&#x2F;&#x2F;cloud.withgoogle.com&#x2F;cloudsecurity&#x2F;podcast&#x2F;ep114-minimal-viable-secure-product-mvsp-is-that-a-thing&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;cloud.withgoogle.com&#x2F;cloudsecurity&#x2F;podcast&#x2F;ep114-min...</a>