What makes GitLab "industry-standard" and Forgejo not?
a corporate/b2b saas environment without stuff like this is often a non starter.
- SOC2
- ISO/IEC 27001:2022
- ISO/IEC 27017:2015
- ISO/IEC 27018:2019
- VPAT 508
https://about.gitlab.com/security/
no mention of these on the forejo site, so i can’t put “our internal software is all SOC2/ISO NUMBER compliant” as a bullet point on a slide deck.
it is theatre. but it’s industry theatre.
> ISO/IEC 27001 requires that management:
> Systematically examine the organization's information security risks, taking account of the threats, vulnerabilities, and impacts;
> Design and implement a coherent and comprehensive suite of information security controls and/or other forms of risk treatment (such as risk avoidance or risk transfer) to address those risks that are deemed unacceptable; and
> Adopt an overarching management process to ensure that the information security controls continue to meet the organization's information security needs on an ongoing basis.
probably not. but it does mean you can focus on the rest of your stack rather than having to go through every single process from the ground up.
(Aside: I would likely never use Gitlab by choice, and would consider looking into Forgejo)