3 ms·
I don't think you understand SOC2 at all. The business itself defines what controls they want to be tested and included in the SOC2 report. This is why SOC2 r
by Khaine 6y ago
I don't think you understand SOC2 at all.
The business itself defines what controls they want to be tested and included in the SOC2 report. This is why SOC2 reports are simultaneously the worst and best (in most cases, only way to get assurance) assurance you can get over a third party.
The problem is, as you say people who consume SOC2 reports don't understand what they are getting.
- staticassertion 6y agoWell I think I do understand SOC2 :) I am well aware of how controls are defined, it was only just an hour ago that I was reviewing our controls with the feedback from our auditor.
- Khaine 6y agoSo how would you look to get assurance over third parties without SOC reports? I am happy to concede that SOC reports are terrible, but at the moment they are one of the few effective ways to get assurance over third parties.
- staticassertion 6y agoAs I said in another post, > This is a very hard problem. It's a regulation on a quality that is a very fast moving target with weak consensus. Doing this in a regulatory way just isn't viable today. > the few effective ways I disagree that they're effective. I don't think they are. Lots of companies with a SOC2 are breached, no company that people consider 'very secure' has earned that reputation due to SOC2 (or any other compliance for that matter).