7 ms·

You seem to have a problem with the standard that says SOC3 facilities should have encrypted hard drives, not the auditor who is actually trying to enforce that

You seem to have a problem with the standard that says SOC3 facilities should have encrypted hard drives, not the auditor who is actually trying to enforce that standard. You take it up with SOC3, not the auditor. :-) You're also assuming the auditors are familiar with all sorts of technology and security mumbo-jumbo. In my experience, they typically are not - their skillset is to "audit", not make sense of latest 10000 rounds of mybestcrypto. Today they may be auditing a SOC3 facility, tomorrow it'll be a car manufacturing plant. The only "source of truth" is the standard they carry, and any deviation has to be noted. It is as simple as that!

garciasn 6y ago
I do take issue with audits that do not require critical thought; you are correct. The audit itself could be (and in this case is) self contradictory, which can be dangerous.
AnthonyMouse 6y ago
> You take it up with SOC3, not the auditor. But that's the problem. There is no viable mechanism for doing this. Even if you somehow actually succeeded in convincing them to change the checklist, it would be next year's checklist, or the one ten years from now, not the one you have to establish "compliance" with right now in order to get the bureaucratic sign off, and thereby implement the spurious requirement.
- whydoyoucare 6y ago
  Two things that I am aware of: (a) All standards provide a "comment period". Along with contact details for those standard bodies, there is a viable mechanism to some extent. (b) Standards are broad, which makes the language a bit abstract, and this can be a problem. However, they also include "compensating controls", which are typically used as a wedge to avoid a compliance failure. I have had great success with several auditors with a polite conversation trying to help them map their goals to our controls. Yes, you will always meet an auditor or two who won't accept anything but the written word of the standard. Like any other industry, there are smart and dumb auditors. :-)
michaelt 6y ago
> You seem to have a problem with the standard that says SOC3 facilities should have encrypted hard drives, not the auditor who is actually trying to enforce that standard. Isn't that exactly what the article says? That auditors are looking for compliance, not security?

garciasn 6y ago

I do take issue with audits that do not require critical thought; you are correct. The audit itself could be (and in this case is) self contradictory, which can be dangerous.

AnthonyMouse 6y ago

> You take it up with SOC3, not the auditor. But that's the problem. There is no viable mechanism for doing this. Even if you somehow actually succeeded in convincing them to change the checklist, it would be next year's checklist, or the one ten years from now, not the one you have to establish "compliance" with right now in order to get the bureaucratic sign off, and thereby implement the spurious requirement.

whydoyoucare 6y ago
Two things that I am aware of: (a) All standards provide a "comment period". Along with contact details for those standard bodies, there is a viable mechanism to some extent. (b) Standards are broad, which makes the language a bit abstract, and this can be a problem. However, they also include "compensating controls", which are typically used as a wedge to avoid a compliance failure. I have had great success with several auditors with a polite conversation trying to help them map their goals to our controls. Yes, you will always meet an auditor or two who won't accept anything but the written word of the standard. Like any other industry, there are smart and dumb auditors. :-)

michaelt 6y ago

> You seem to have a problem with the standard that says SOC3 facilities should have encrypted hard drives, not the auditor who is actually trying to enforce that standard. Isn't that exactly what the article says? That auditors are looking for compliance, not security?