4 ms·
Are these external audits just SOC checklists where they're basically just looking at policies and processes for employees or are teams of auditors routinely co
by autoexec 3y ago
Are these external audits just SOC checklists where they're basically just looking at policies and processes for employees or are teams of auditors routinely coming into each office and data center to physically examine servers and trace network cables while taking an independent inventory of all the hardware that sensitive data touches and the software running on that hardware?
SOC compliance and external audits can help keep things reasonably secure and prevent the totally careless/incompetent handling of data, but I'm skeptical that they would typically be robust enough to detect Microsoft's own equivalent of Room 641A let alone the actual hardware installed by the feds which MS itself isn't allowed to touch.
- sabarn01 3y agoI don't know if I can say what we have to turn over to the auditors that isn't in the public document. As to verifying the hardware we buy our hardware from other companies who have their own controls. If you dig far enough down everything ultimately comes to trust as no one can verify everything.
- nyc_data_geek1 3y agoAll the more reason to only ever trust a corporation to do what is in the interest of their bottom line, including lie to your face, collect and sell your data, and violate the law whenever the financial disincentive is less than the profit potential.