4 ms·
> SOC2 is the best-known infosec certification, and the only one routinely demanded by customers. In the US... and I think that SOC2 is not an "infosec" certi
by xtracto 4y ago
> SOC2 is the best-known infosec certification, and the only one routinely demanded by customers.
In the US... and I think that SOC2 is not an "infosec" certification per se but more of a generic policies and procedures certification. When I sucessfully took a startup to SOC2 certification, we were doing PCI DSS Level 1 compliance at the same time. SOC2 was very light on InfoSec per se (it was more "bureaucracy"), whereas PCI leaned heavily into InfoSec itself.
Of course that was for an American company, the rest of the world uses ISO 27001
- NovemberWhiskey 4y agoSOC2 is absolutely an infosec certification; it's just one that's premised around the idea that that the service organization should have its own mechanisms for achieving security goals and then demonstrate compliance with them. This is different from PCI-DSS which is single-domain-specific and highly prescriptive at a technical level as a result.