4 ms·
Yes. But my point is the burden of compliance causes at least that much effort. Vibing security and calling it done with a rubber stamp is insufficient because
by fnordpiglet 1y ago
Yes. But my point is the burden of compliance causes at least that much effort. Vibing security and calling it done with a rubber stamp is insufficient because even requiring an audit people try to fudge around the edges. Without a detailed audit with high compliance expectations you’ll just get outright lies by default.
- stackskipton 1y agoI feel like certification is worse. People fudge the truth, get the certification, get compromised and because they had certification, no meaningful action is taken. InfoSec problem is not lack of "certification" but lack of consequences.
- tguvot 1y agoin fedramp you can get delisted from marketplace and your certification revoked and get banned from doing another certification