3 ms·
SOX compliance is a huge PITA but has driven engineering changes that have made the orgs Ive worked at much more secure. In particular, rules that require code
by pm90 4y ago
SOX compliance is a huge PITA but has driven engineering changes that have made the orgs Ive worked at much more secure.
In particular, rules that require code reviews, auditing around production deployments, regular patching and exercising backup/recovery mechanisms have all made the systems Ive worked on operationally resilient.
It does depend on what kind of expertise your compliance team has (or the 3rd party tool you might use). But followed in spirit, SOX regulations have probably been a net benefit.
- blowski 4y agoI thought SOX was mostly financial. What you’re saying here sounds more like SOC. are they connected?
- pm90 4y agoYou can think of SOX as RFC and SOC2 as an implementation of it. https://www.logicgate.com/blog/a-comparison-of-soc-and-sox-compliance/ https://www.logicgate.com/blog/a-comparison-of-soc-and-sox-c...
- solar-ice 4y agoSOC 2 is the bit that changes how software development is done, and has literally nothing to do with SOX, even according to that article.
- collegeburner 4y agoThere is literally 0 requirement to implement SOC2 for SOX. They are not related at all aside from that a lot of organizations do both. I'm kinda curious now where you got this idea?