3 ms·
Yup, for the most part you define your own controls! Even type 2 is pretty hard to "fail" if you're serious about security. You're more likely to just get minor
by robertclaus 1y ago
Yup, for the most part you define your own controls! Even type 2 is pretty hard to "fail" if you're serious about security. You're more likely to just get minor exceptions in the report for being sloppy about something.
- tptacek 1y agoI think we've managed to get an exception in every Type 2 we've done (each time, some dumb paperwork policy thing; I think in one instance we were untimely with a post-facto merge PR signoff, the closest we've come to an actual slip. The first exception we got, I raised hell and wrote a management statement. But nobody cares about trivial exceptions, and so I've learned not to here either. But, true, I didn't even pay attention in our last Type 2 (I don't run security here) --- passing was a foregone conclusion.
- jonathaneunice 1y ago"Nobody cares about trivial exceptions"...except the most persnickety GRC teams of your most persnickety enterprise customers. Or at least *cough*, that's what I've heard.