Hacker News Reader

I've been pushing NIST on SOC2 auditors for years. They always accept it once given a link.

Makes sense. The thing people forget about SOC2 is that it's very not-technical and very much so written by CPA's. No two SOC2's are identical. Hell the same companies SOC2 done by different auditors will be different.

Saying "The United States of America National Institute of Standards and Technology says X on page 423 of Special Publication 800-53 revision 5" is a really awesome "We're doing things the RIGHT way".

Yes, it's this rolling on your back and preemptively trying to cover all eventualities that does stuff like this.

It seems like none wants to actually justify their decisions to auditors as its more time critical when the audit happens.

If only everyone involved with security compliance could learn the lesson that John learned in The Phoenix Project, developers and ops folks would experience a lot less pressure to treat the pantry like Fort Knox. There is not only evidence that goes against the expectations of many auditors, but there's also no requirement that compliance of everything be implemented through costly software and network changes, because physical security and process can be used for compliance as well.

Reply on news.ycombinator.com