4 ms·
I went through the SOC 2 (Type 1 and 2) process in the last few years and I nearly quit with the amount of useless, ill-informed nonsense I had to submit to. T
by qntmfred 3y ago
I went through the SOC 2 (Type 1 and 2) process in the last few years and I nearly quit with the amount of useless, ill-informed nonsense I had to submit to.
The regulatory controls themselves are mostly reasonable, but seeing the competency and rigor (lack thereof) of the auditors was completely demotivating.
- gurchik 3y agoI see a lot of people say this. Maybe I've just been lucky but all of my security audits have been sensible and easy. The only exception was at one company, an auditor flagged that weren't in compliance with "antivirus software is installed on all storage servers," and as they defined it, that would have included our Docker image repositories and S3 buckets. They gave us some suggestions on how we could do this, for example a Lambda-based solution that would scan all files uploaded to S3. We just said "no" and they dropped it.
- atonse 3y agoOur SOC2 audit was mostly fine. The only “huh?” Moment I remember was when they asked me whether we used MFA, and then I proceeded to talk about how we have TOTP, WebAuthn, etc for our “2FA” as I happened to refer to it, and after talking for a minute about it, the auditor said, “just want to clarify, do you have any MFA configured”… at that point I realized how much they were just blindly marking checkboxes. So I just said “yes we do.”
- 6D794163636F756 3y agoI've been the internal poc for a soc2 before. The external auditors were all lawyers. As such what mattered was strict compliance with the wording of the standards. With them what we didn't say was nearly as important as what we di