Explain that to the auditors… on whose lap does the decision fall?
There has to be a responsibility model for that; somebody who can say “we don’t do X even if the auditors say we should, because Y”. But I see where you are coming from, I’ve seen security theater to cost $$$$$$$ at the org I’m part of.
alt Hacker News
There has to be a responsibility model for that; somebody who can say “we don’t do X even if the auditors say we should, because Y”. But I see where you are coming from, I’ve seen security theater to cost $$$$$$$ at the org I’m part of.