3 ms·
My general thought on silly security certification requirements is that I wonder if they're necessarily silly or just covering rare (but catastrophic) events. F
by marcinzm 6y ago
My general thought on silly security certification requirements is that I wonder if they're necessarily silly or just covering rare (but catastrophic) events. For example, my whole company had a great laugh when a client required us to have a Pandemic Policy in 2019. In 2020 we stopped laughing about it.
- dsr_ 6y agoWe had a pandemic plan as part of our general DR/BC (disaster recovery / business continuity) plan for more than a decade. The joke was that we exercised it several times a year -- in winter, when the big snow storms hit and everyone worked from home. In February 2020 I pointed out that we had not had a single mass work-from-home emergency, so shouldn't we hold the exercise? I convinced enough execs that we held a two-day test, on the basis that nearly anything can be postponed one day in order not to do it from home, but perhaps not two. We solved a bunch of issues... and then we left the office in mid-March and haven't been back en-masse since.
- tptacek 6y agoLiterally the only reason to do SOC2 is if an important customer prospect that you are definitely going is demanding it; in fact, it might be better to say the only reason to do it is that you have to because you've got a contingent PO.