6 ms·
If it so bad there is actually a whistleblower then how do they pass their ISO27001 audits? Bit too friendly with TUV Nord? https://cariad.technology/content/d
by jsiepkes 2y ago
If it so bad there is actually a whistleblower then how do they pass their ISO27001 audits? Bit too friendly with TUV Nord?
https://cariad.technology/content/dam/digitalmindofmobility/documents/CARIAD-SE-ISO_9001-certificate.pdf https://cariad.technology/content/dam/digitalmindofmobility/...
EDIT: Just noticed this is an ISO9001 certificate. Though on their job offer site they do ask for "Foundational understanding of security related regulations and standards preferred (e.g. ISO21434, ISO27001, NIST-800)". Unclear if they are actually ISO 27001. Found the 9001 one by fluke, they don't seem to list that one on their site either.
- tuwtuwtuwtuw 2y agoThe fact that you have passed audits isn't a guarantee (or even an indication) that you don't have major security vulnerabilities.
- starbugs 2y ago> The fact that you have passed audits isn't a guarantee (or even an indication) that you don't have major security vulnerabilities. Please explain that to my IT department.
- rf15 2y agoTÜV certification has always been more about certification theater and being able to verify that you don't have egregious amounts of negligence than certifying that you are doing your work well. edit: I've never prepared for our audits and we always get our certification, no matter what they find as long as you say "yes, we are aware"
- gsich 2y ago27001 does not specify implementation details.
- tremon 2y agoNot sure about 27000, but ISO9001 is a paper audit only: you pass or fail them based on your defined business processes. The technical configuration of your systems is outside the scope of the audit.