Hacker News Reader

SOC 2 compliance as well. If you cannot check the box that says "all changes are reviewed prior to release" you're SOL.

Exactly what I was thinking… code reviews are a major component of many security requirements.

> your SOX narrative doesn't cite code review

Thats not for all code. Only the parts of code that need sox compliance. Plus its usually implemented as person doing the deploy is different from person writing the code. So yea code review isn't a requirement, requirement is that a single person cannot make change in the production.

I think most lawyers look at this and say "all code needs sox compliance" because you can't easily guarantee some bit of code won't end up being checked into a server binary that runs in prod at some point.

I think as long as you have a good enough narrative about production change control (IE, review all code that is added to a release candidate, when the RC is about to be promoted) then you don't need code review of all code required.

That said, I find that in many cases, people make good code review comments and I've learned how to push back against unnecessary nits (at google, it's called "Ack.")