3 ms·
Curious - would you even pass SOC2 as a one man band? Assuming you did everything else right, the report would still highlight the risk of one person bus factor
by winrid 4y ago
Curious - would you even pass SOC2 as a one man band? Assuming you did everything else right, the report would still highlight the risk of one person bus factor.
- tptacek 4y agoThey don't just make things up in the report; there's a set of controls and risks they capture. "Bus factor" isn't one of them.
- Tostino 4y agoBut things like "was there a review of this change?" are.
- tptacek 4y agoReviews don't have to be done synchronously or by different people. You could get a SOC2 report as a single-person operation; like any company that doesn't exactly follow the mold of the modal SAAS startup, you'll end up having more of a scoping conversation with your auditor than your peer companies would, but you don't get charged extra for that.
- winrid 4y agoNeat! So only being one person isn't a risk? Interesting.