3 ms·
Well I think I do understand SOC2 :) I am well aware of how controls are defined, it was only just an hour ago that I was reviewing our controls with the feedb
by staticassertion 6y ago
Well I think I do understand SOC2 :)
I am well aware of how controls are defined, it was only just an hour ago that I was reviewing our controls with the feedback from our auditor.
- Khaine 6y agoSo how would you look to get assurance over third parties without SOC reports? I am happy to concede that SOC reports are terrible, but at the moment they are one of the few effective ways to get assurance over third parties.
- staticassertion 6y agoAs I said in another post, > This is a very hard problem. It's a regulation on a quality that is a very fast moving target with weak consensus. Doing this in a regulatory way just isn't viable today. > the few effective ways I disagree that they're effective. I don't think they are. Lots of companies with a SOC2 are breached, no company that people consider 'very secure' has earned that reputation due to SOC2 (or any other compliance for that matter).