3 ms·
My experience with it was most of time, there was a ton of truth stretching going on. Similar to SOC2 compliance. If a system couldn't be brought into complianc
by stackskipton 1y ago
My experience with it was most of time, there was a ton of truth stretching going on. Similar to SOC2 compliance. If a system couldn't be brought into compliance, a ton of stories why it was not in scope or compensating control was adequate.
Yes, there is criminal penalties but I haven't heard of them being enforced outside someone just outright lying.
- fnordpiglet 1y agoYes. But my point is the burden of compliance causes at least that much effort. Vibing security and calling it done with a rubber stamp is insufficient because even requiring an audit people try to fudge around the edges. Without a detailed audit with high compliance expectations you’ll just get outright lies by default.
- stackskipton 1y agoI feel like certification is worse. People fudge the truth, get the certification, get compromised and because they had certification, no meaningful action is taken. InfoSec problem is not lack of "certification" but lack of consequences.
- tguvot 1y agoin fedramp you can get delisted from marketplace and your certification revoked and get banned from doing another certification