4 ms·

The cost should be billed to the department with the users that were affected. The laptops are assigned to those employees, so normally any kind of compliance/s

by manv1 4y ago

The cost should be billed to the department with the users that were affected. The laptops are assigned to those employees, so normally any kind of compliance/spend should be associated with them as well. It doesn't matter if those costs are mandated by compliance, it's up to each department to keep up. FYI for those non-corporate readers, if there's an actual compliance department that means that the cost of non-compliance is really, really high. That either means financial or government/DoD.

pas 4y ago
it might also be healthcare, or nuclear/aviation, no? > The cost should be billed to the department with the users that were affected. It doesn't really matter. These are arbitrary slicings and dicings of one big monolithic blob anyway, internally connected by interdependent causal links. It's a "simple" management decision how compliant the whole operation gets to be, also weighing the cost of compliance versus consequences of non-compliance (from simple things like "have to massage the scope during the next audit" to "might impact a potential lawsuit" to regulator fines us to personal criminal responsibility for the CEO), similarly it's a management decision how much spending each org/department can do on getting compliant without requesting budget for it, etc, etc. In this case the priorities are clear and it just happens that there is this big discontinuity (crisis!) that will probably look like a bad overall trade off, something that should have been prevented. Will this even result in some change to the whole decision-making hierarchy? Unlikely. If this hierarchy was able to completely impervious to all the input from below (emails, calls, meetings, 1 year grace period, etc) then it likely does not matter that these devices will get wiped.

4 ms·

The cost should be billed to the department with the users that were affected. The laptops are assigned to those employees, so normally any kind of compliance/s

by manv1 4y ago

pas 4y ago
it might also be healthcare, or nuclear/aviation, no? > The cost should be billed to the department with the users that were affected. It doesn't really matter. These are arbitrary slicings and dicings of one big monolithic blob anyway, internally connected by interdependent causal links. It's a "simple" management decision how compliant the whole operation gets to be, also weighing the cost of compliance versus consequences of non-compliance (from simple things like "have to massage the scope during the next audit" to "might impact a potential lawsuit" to regulator fines us to personal criminal responsibility for the CEO), similarly it's a management decision how much spending each org/department can do on getting compliant without requesting budget for it, etc, etc. In this case the priorities are clear and it just happens that there is this big discontinuity (crisis!) that will probably look like a bad overall trade off, something that should have been prevented. Will this even result in some change to the whole decision-making hierarchy? Unlikely. If this hierarchy was able to completely impervious to all the input from below (emails, calls, meetings, 1 year grace period, etc) then it likely does not matter that these devices will get wiped.