3 ms·
For those wondering about ISO 27001 - it's a standard for international security management, and popular in Europe. However in the US it's not very relevant or
by sgt 1y ago
For those wondering about ISO 27001 - it's a standard for international security management, and popular in Europe.
However in the US it's not very relevant or even interesting to companies, and some European companies fail to understand that.
SOC 2 is the default and the preferred standard in the US - it's more domestic and less rigid than ISO 27001.
- AtNightWeCode 1y agoName one big US cloud provider or similar that is not ISO 27001 compliant.
- sksjvsla 1y agoThe cloud provider can be compliant with your app being so.. Most apps will not pass an ISO audit unless designed to do so.
- ozim 1y agoISO27001 I wouldn’t call rigid, most of the stuff you should be doing anyway if you use any software. checking for evidence that you are doing those things I would call ridgit. SOC2 as attestation doesn’t require so much documentation.
- sgt 1y agoSure, it depends on the implementation of your ISMS. Ideally you want to follow the control guidance in 27002. They've done a lot of thinking on this.
- candiddevmike 1y agoHaving been through both, I much prefer the "rigid" ISO 27001 as the SOC2 audits seem to be based on how well you vibed with the auditor and the auditors competency more than anything. The things they are auditing seem overly broad and open to interpretation, and the auditors descriptions of your controls can easily be twisted.