2 ms·

Functions for as long as the auditor is looking in that project areas direction, in my experience. Sure, it may raise the baseline, but only as much as a teach

• jonathaneunice 1y ago
  The skepticism is warranted, but the audits must be periodically refreshed. At least for our auditor, that means pentest and remediation steps, risk assessment and treatment steps, BCP/DRP and IRP must be updated and each tested, vulnerabilities reported, access audited, etc. Ship-shapeness becomes metronomic and mandatory. The gating factor isn't the duration or intensity of the auditor's gaze, but how well the local infosec team can use that gaze to bump the organization forward ("make hay while the sun shines"), and whether/how well it can make the process a ratcheting movement forward. If everything and everyone could backslide 100%, I would share your cynicism. That decay is not inevitable IME. Of course, YMMV.