4 ms·
I have worked with a large healthcare firm at two different agencies now who outsources compliance checks to overseas teams. There is nothing but a lengthy chec
by garciasn 6y ago
I have worked with a large healthcare firm at two different agencies now who outsources compliance checks to overseas teams. There is nothing but a lengthy checklist to move through and if you do not meet the standards of the checklist, you fail.
There is no critical thought or evaluation of each step; it’s a simple pass/fail. Example would be “are your drives encrypted at rest?” It doesn’t matter if you’re in a SOC3 facility, located 25 feet below street level in 8 foot thick concrete walls and your files are distributed in pieces across millions of drives throughout the data center. Nope. The drives must be encrypted at rest. Pass. Fail.
Sigh.
- edrobap 6y ago> SOC3 facility, located 25 feet below street level in 8 foot thick concrete walls One of objectives for encryption at rest is shredding. The drives may not remain in the secure facility after the end of life. > your files are distributed in pieces across millions of drives throughout the data center Distributing data could actually secure it if individual pieces are meaningless.
- garciasn 6y agoShredding happens on site but your point would stand otherwise.
- arp242 6y ago"The files on my drive are encrypted using the UTF-8 algorithm".
- whydoyoucare 6y agoYou seem to have a problem with the standard that says SOC3 facilities should have encrypted hard drives, not the auditor who is actually trying to enforce that standard. You take it up with SOC3, not the auditor. :-) You're also assuming the auditors are familiar with all sorts of technology and security mumbo-jumbo. In my experience, they typically are not - their skillset is to "audit", not make sense of latest 10000 rounds of mybestcrypto. Today they may be auditing a SOC3 facility, tomorrow it'll be a car manufacturing plant. The only "source of truth" is the standard they carry, and any deviation has to be noted. It is as simple as that!
- garciasn 6y agoI do take issue with audits that do not require critical thought; you are correct. The audit itself could be (and in this case is) self contradictory, which can be dangerous.
- AnthonyMouse 6y ago> You take it up with SOC3, not the auditor. But that's the problem. There is no viable mechanism for doing this. Even if you somehow actually succeeded in convincing them to change the checklist, it would be next year's checklist, or the one ten years from now, not the one you have to establish "compliance" with right now in order to get the bureaucratic sign off, and thereby implement the spurious requirement.
- whydoyoucare 6y agoTwo things that I am aware of: (a) All standards provide a "comment period". Along with contact details for those standard bodies, there is a viable mechanism to some extent. (b) Standards are broad, which makes the language a bit abstract, and this can be a problem. However, they also include "compensating controls", which are typically used as a wedge to avoid a compliance failure. I have had great success with several auditors with a polite conversation trying to help them map their goals to our controls. Yes, you will always meet an auditor or two who won't accept anything but the written word of the standard. Like any other industry, there are smart and dumb auditors. :-)
- 6y ago