Engineers often over-think compliance. SOC2 is regulatory capture, and an audit that tests your controls. You define the appropriate controls. As long as you do what you say you're going to do, you should pass the audit. It's not rocket science. It's a feature of a correct system that it is auditable. How easy it is to audit is really a function of your maturity. SOC2 and its ilk such as ISO27001 are just maturity signalling mechanisms. Stop overthinking it or applying black and white rules -- in actual practice its always shades of grey and most auditors are just happy to have an engaged and switched on team to be auditing, vs someone who treats it as adversarial. You're paying them!
The problem is it's not the engineers that overthink it. The requirement for soc2 usually comes with the first "serious" customer. It is usually a big blocker on some fat contract and now the business makes it your problem for the next 6 months.
So what do you do? You engage and some 3rd party 1800-need-soc2 clowns which will hold your hand and implement all the cookie cutter solutions they know will make auditor happy (oh and btw, they know the auditor personally).
This stance is a breath of fresh air. In my experience change management is the first thing to slap on when a bad release happens.
I've worked at a large enterprise that have a "Change Advisory Board", that you need to convince when you want to bump the major version on your linter. It has the effect of velocity slowing down to a crawl. Changes have to large, since otherwise it wouldn't be approved by the CAB. A slow mess.
At my current place we have to loudly declare "I CONFIRM COMPLIANCE" in every PR description. I'm not sure that anyone knows why, but it keeps the bureaucrats happy. Shrug
My favorite thing about CABing things that shouldn't be CABd is that it then bunches up changes that all happen at the same time... after the CAB meeting. Now if something breaks, it could be any of the dozens of things that just got pushed in the 15 minutes after the meeting.
> What they ask for is that changes are authorized, tested, approved, and recorded — and pull requests are just one way of doing that.
I'm pretty unclear how approvals are ensured in your system?
Authorisation and recording are pretty much out-of-the-box with a version control system, CI can guarantee testing, but how are we demonstrating approval without any evidence of change reviews?
Youre required to have a policy. That policy may be throwing bananas at the wall, but if it's documented and you follow it, you're compliant with policy.
The better way is that for each policy you look at what do you actually want to do and how you want to do it, and then write that down as the policy. Now the policy makes sense because it's how you wanted to do it anyway.
I've set up policies and processes from the ground up for SOC2 audits in startups, that's how I do it.
I was in a high trust environment that didn't use dual auth on some things. They lost $250k to embezzlement.
High trust is high trust until someone exploits it, and the likelihood of encountering an exploit (embezzlement, fraud, political speech, etc.) approaches 100 as the total number of staff hours increase.
Does there exist any tool to analyze PR feedback quality and usefulness?
I've been trying to explain to compliance employees that if the majority of PR reviews anyway is just "LGTM - Just merge" (I don't care), what's the actual value of PRs? It's just facade.
On a different note, we're looking into artifact attestations and admissions through Sigstore, which is solves many of the same challenges but through different means.
So an engineer who knows your codebase and tests can sneak in malicious code/backdoors because you're high trust.
And I am guessing you'll extend that high trust to your agents/'orbs' next. And I am sure you'll find an auditor who'll go with it coz frankly most don't care.
I am not surprised there are folks willing to do this, but I am surprised that you feel you must brag about it. And you ARE bragging when you title the post the way you did. Good luck.
No, that's not a brag but a suggestion to take things into context and not apply soc2 as a cookie cutter solution where a 20k employee enterprise and a 20 people startup must share commonalities.
In a 20 people startup it's very likely that most engineers have access to production anyway and can inject malicious stuff directly, so PRs stop no one really.
> So an engineer who knows your codebase and tests can sneak in malicious code/backdoors because you're high trust.
What is the alternative? Bumping a dependency in a PR and getting a LGTM can also introduce a backdoor.
That's another form of high trust: your trusting the publisher of the dependency.
High trust comes with high responsibility, which is easier to enforce when the trusted party is an individual on your team with generally aligned incentives, rather than an organization or unpaid individual on the internet serving many.
So what do you do? You engage and some 3rd party 1800-need-soc2 clowns which will hold your hand and implement all the cookie cutter solutions they know will make auditor happy (oh and btw, they know the auditor personally).
I've worked at a large enterprise that have a "Change Advisory Board", that you need to convince when you want to bump the major version on your linter. It has the effect of velocity slowing down to a crawl. Changes have to large, since otherwise it wouldn't be approved by the CAB. A slow mess.
At my current place we have to loudly declare "I CONFIRM COMPLIANCE" in every PR description. I'm not sure that anyone knows why, but it keeps the bureaucrats happy. Shrug
I'm pretty unclear how approvals are ensured in your system?
Authorisation and recording are pretty much out-of-the-box with a version control system, CI can guarantee testing, but how are we demonstrating approval without any evidence of change reviews?
"We don't know why we're doing it - it's just mandatory".
The better way is that for each policy you look at what do you actually want to do and how you want to do it, and then write that down as the policy. Now the policy makes sense because it's how you wanted to do it anyway.
I've set up policies and processes from the ground up for SOC2 audits in startups, that's how I do it.
High trust is high trust until someone exploits it, and the likelihood of encountering an exploit (embezzlement, fraud, political speech, etc.) approaches 100 as the total number of staff hours increase.
I've been trying to explain to compliance employees that if the majority of PR reviews anyway is just "LGTM - Just merge" (I don't care), what's the actual value of PRs? It's just facade.
On a different note, we're looking into artifact attestations and admissions through Sigstore, which is solves many of the same challenges but through different means.
But how do they review each other's work? Prs are indispensable for collaboration...
We...just read the commits, and talk to each other.
We're also pretty trigger happy with the Huddle button in Slack.
Nobody on the team would go back to mandatory PRs
And I am guessing you'll extend that high trust to your agents/'orbs' next. And I am sure you'll find an auditor who'll go with it coz frankly most don't care.
I am not surprised there are folks willing to do this, but I am surprised that you feel you must brag about it. And you ARE bragging when you title the post the way you did. Good luck.
In a 20 people startup it's very likely that most engineers have access to production anyway and can inject malicious stuff directly, so PRs stop no one really.
What is the alternative? Bumping a dependency in a PR and getting a LGTM can also introduce a backdoor.
That's another form of high trust: your trusting the publisher of the dependency.
High trust comes with high responsibility, which is easier to enforce when the trusted party is an individual on your team with generally aligned incentives, rather than an organization or unpaid individual on the internet serving many.