3 ms·

What about audits in a serverless world? How do you approach that?

• toomuchtodo 10y ago
  Audits and compliance aren't required at scale /s
• Spivak 10y ago
  Serious question. What are you auditing? You have access to all of your code and data and everything else seems like it would be up to your provider. Wouldn't you know up front when you're choosing a stack whether they meet your compliance demands?
  • MS_Buys_Upvotes 10y ago
    > Wouldn't you know up front when you're choosing a stack whether they meet your compliance demands? No, not always. Good luck with the refactor (complete rebuild?) when the time comes.
  • dragonwriter 10y ago
    > Wouldn't you know up front when you're choosing a stack whether they meet your compliance demands? The number of actors in industries with particularly notable compliance requirements (like HIPAA) that have internally very weak, inaccurate, ideas of the actual requirements and who discover the pracctical meaning of key elements both long after they've been in force and long after they've relied on an inaccurate understanding is, well, non-negligible.