4 ms·
I see your point: if they were competent, they wouldn't overlook it. My point was more that because SOC-2 is more pedantic (than, say, HIPAA), it's harder for a
by jamiesonbecker 6y ago
I see your point: if they were competent, they wouldn't overlook it. My point was more that because SOC-2 is more pedantic (than, say, HIPAA), it's harder for a SOC-2 auditor to mess this up.
- raverbashing 6y agoNo, I'm saying their audit process focus more in box checking than actually seeing "you left the key under the mat"
- deleted 6y ago[deleted]
- jamiesonbecker 6y agoThe "boxes" to be checked are actually asking open-ended questions about that, and asking you to provide copious written documentation backing up what you are claiming. This process takes weeks or months and is quite expensive.
- JshWright 6y agoAre you talking about HIPAA or SOC2?
- freeone3000 6y agoThe relevant box here is "Are all accesses to production systems logged in an indelible manner?" and "Is the principal of least privilege followed when accessing production systems?" These questions aren't perfect, since they don't actually prevent security issues and merely document them extensively, but answering no to them will fail the audit.