3 ms·
Say no. Name and shame. The soc2 controls in question can be met with a handful of config changes and an antivirus install. (I’ve implemented soc2 controls fiv
by more_corn 5y ago
Say no. Name and shame.
The soc2 controls in question can be met with a handful of config changes and an antivirus install. (I’ve implemented soc2 controls five times)
Full disk encryption with FileVault or Bitlocker
Screen lock
Enable automatic security updates
Use of password manager
Virus scan with ClamAv or windows defender.
If they want an agent to make sure you’re working when you say you’re working I’d pass.
- neonnomad 5y agoThe Drata agent does exactly what you are talking about with a lightweight osquery based read-only agent. Literally just monitors some system settings like screen lock timeout, av-install, updates, etc. We collect that data to then be able to show your auditor you are meeting your controls. Source: I am the Drata CISO
- illud_tempus 5y ago> The Drata agent does exactly what you are talking about Does it also name and shame? ;)