Your snarkiness aside, that’s why it’s important to find an auditor that understands your business. Traditional auditors understand traditional compliance regim

Your snarkiness aside, that’s why it’s important to find an auditor that understands your business. Traditional auditors understand traditional compliance regimes. If you want to use innovative compliance methodology, like relying on infrastructure as code for instance, then you need an auditor who understands those practices. Take PCI for example. A couple of years ago they released a document called Cloud Computing Guidelines, which was basically guidance for compliance through software defined network and that sort of stuff. As a PCI QSA (auditor), you may not ever need to know about these guidelines, or that they even exist. But if you want to work with business that rely on them then you’ll need to, and if you want to implement them in your organisation, then you’ll need to find a QSA that understands them.