4 ms·
> for companies who are subject to regulation (publicly- > traded companies, banks, etc.) Well for starters, that's not most companies, or even that many
by peteretep 12y ago
> for companies who are subject to regulation (publicly-
> traded companies, banks, etc.)
Well for starters, that's not most companies, or even that many companies as a percentage of the whole.
The only place I've ever seen (or even heard of this) being done is banks and defense.
It ain't in ISO27001, and so nobody cares.
- ckozlowski 12y agoIn defense, it's too expensive to do in house. However, security software and some operating systems, either closed source or open, are evaluated under Common Criteria (https://www.commoncriteriaportal.org/ https://www.commoncriteriaportal.org/) But the evaluation process is rather long and often lags behind the current version by a year or more in some cases.