Hacker News Reader

Yup, for the most part you define your own controls! Even type 2 is pretty hard to "fail" if you're serious about security. You're more likely to just get minor exceptions in the report for being sloppy about something.

View on HN

I think we've managed to get an exception in every Type 2 we've done (each time, some dumb paperwork policy thing; I think in one instance we were untimely with a post-facto merge PR signoff, the closest we've come to an actual slip. The first exception we got, I raised hell and wrote a management statement. But nobody cares about trivial exceptions, and so I've learned not to here either.

But, true, I didn't even pay attention in our last Type 2 (I don't run security here) --- passing was a foregone conclusion.

"Nobody cares about trivial exceptions"...except the most persnickety GRC teams of your most persnickety enterprise customers.

Or at least *cough*, that's what I've heard.

Reply on news.ycombinator.com