3 ms·
Just the fact that SOC 2 auditors are CPAs speaks enough. I remember working at a large e-commerce company, and the InfoSec offers told me that we didn't care a
by nikolay 2y ago
Just the fact that SOC 2 auditors are CPAs speaks enough. I remember working at a large e-commerce company, and the InfoSec offers told me that we didn't care about PCI compliance as we could only get fined, but we could get into orange jumpsuits for mishandling PII. And that was over a decade ago, talking only about names, addresses, emails, and phone numbers. With HIPAA leaks, it's tons more than just that, and I'm not sure what the consequences are, but back then, we didn't want to sell prescription eyewear only due to the HIPAA burden.