4 ms·
GP's point is that having SSO and protected git branches _is_ starting the SOC2 process.
by rendaw 2y ago
GP's point is that having SSO and protected git branches _is_ starting the SOC2 process.
- koolba 2y agoThat and having a ticket system (e.g., Jira) to track why you touched prod and you can answer just about every question.
- tptacek 2y agoWe don't have that, and didn't need it for SOC2. (We have other ways of tracking prod changes, but our auditors don't know anything about them.)
- tptacek 2y agoI'm pretty sure that's not what the author meant. Again: those are things you should do regardless of whether you're ever going to get SOC2 (and a lot of startups shouldn't).
- deleted 2y ago[deleted]