SOC2: The screenshots will continue until security improves
Part of taking on SOC 2 is also choosing whether you want your attitude to be &quot;Let&#x27;s do the minimum to get past the audit&quot; and &quot;Let&#x27;s take this framework, and figure out where we can learn from it.&quot;<p>The post mentions background checks. On the one hand, I understand there&#x27;s a real issue with these. On the other, if my PAAS isn&#x27;t ensuring repeat offender fraudsters don&#x27;t have access to sensitive data, that&#x27;s possibly an area of concern. Hopefully the things they took from the other mentioned company do increase due diligence in vetting employees who have access to sensitive&#x2F;regulated information.<p>Use it as a framework to actually think about BCP, DRP, etc, etc, and it won&#x27;t be a total waste of time.<p>Edit:
Also adding I bring up background checks as an example of learning from vetted practices, rather than trying to attack the decisions of fly. I respect this article, especially where it&#x27;s easy for people on the internet to criticize decisions, when the reality is security is a series of tradeoffs, and to function as a business means having imperfect processes.