6 ms·
Youre required to have a policy. That policy may be throwing bananas at the wall, but if it's documented and you follow it, you're compliant with policy.
by abofh 1mo ago
Youre required to have a policy. That policy may be throwing bananas at the wall, but if it's documented and you follow it, you're compliant with policy.
- whirlwin 1mo agoThat's a good way to kill off motivated employees. "We don't know why we're doing it - it's just mandatory".
- charcircuit 1mo agoThe policy can be changed.
- rho138 1mo agoUnless you’re every company I’ve worked st over the past 20 years.
- jjav 1mo agoOnly if you write a bad policy, so don't do that. The better way is that for each policy you look at what do you actually want to do and how you want to do it, and then write that down as the policy. Now the policy makes sense because it's how you wanted to do it anyway. I've set up policies and processes from the ground up for SOC2 audits in startups, that's how I do it.
- rho138 1mo agoGreat, so stepping into any organization green where the subvert command is to be unwilling to update policy will enable this.
- ozim 1mo agoSmart employees totally understand: "we do it because it makes it easier to explain to auditors, customers, new employees, non technical managers".
- rho138 1mo agoNo, cogs understand that. Smart employees want to update policies to be an effective mandate versus lip service to the C-suites asshole
- orev 1mo agoWhen the audit happens, the auditors also consider if the policy meets the control objectives. If it doesn’t, you’re going to fail.
- zvr 1mo ago"Write what you do. And then do what you wrote."