Hacker News new | ask | show | jobs
by tptacek 365 days ago
Cosign all of this wholeheartedly. Push back!

The ratcheting back system scope thing is super good advice I always forget to give, too. You can get your entire software security program wrapped up in your SOC2 --- but why would you ever want to do that. The security of your software is very relevant to your customers, but it is not and should not be relevant to SOC2.
1 comments
arbus5672 365 days ago
A point to add here on the scoping. This makes sense in a B2C world but for the B2B contracts, our customers specifically check that our scope clause includes all software systems that they are contracting for plus all the support systems that help make it, including your security program etc.
link
tptacek 365 days ago
All our contracts are B2B, and B2B is where all my prior consulting experience was.

I am very fond of telling the story about the very significant security product company a colleague works at where they had a vendor that gave them a series of repeated Type 1s. I don't believe any of this matters.

link