4 ms·
> a) Pentesting 3rd party vendors is extremely uncommon. This is something you rely on a SOC2 for. In my experience this is fairly common? Although that was my
by danpalmer 7y ago
> a) Pentesting 3rd party vendors is extremely uncommon. This is something you rely on a SOC2 for.
In my experience this is fairly common? Although that was my experience working on the pen-testing side so I guess it was a little biased. The company I worked for did a lot of this sort of thing – pen-testing for meeting due diligence requirements.
- staticassertion 7y agoThere are two separate things here. There's going to a company and saying "Are you SOC2? If not, we need you to be, and that requires a pentest - please go do that before we engage." There may also be, in this same vein, "We're strategic partners, we'll help you get that pentest". This is very common, I suspect the vast majority of pentests are compliance (and essentially sales) driven and would fall under this category. That's different from "We have already engaged, you are already compliant with SOC2, you may do your own pentests, we will now separately pay for and manage a pentest of your company". This is not something I've seen too much of - perhaps that's just me not paying attention? But I'd be surprised if this were common at all. Though I want to again restate that the article is focusing on VRP.
- deleted 7y ago[deleted]