News for hackers. Stuff that matters.

gearnode

Re:An Open Letter to Aicpa and ISO Accreditation Bodies on Friday March 20, 2026 @12:23PM (#47456846)
The division of labor between implementation, documentation, and sign-off isn't the bug. It's the design. Independence between those layers is how you get credible assurance (in theory).

The bug is when nobody actually verifies. The audit firm holds the mandate to look at the full picture. When they sign without doing that, independence becomes a gap. And right now, the bodies supervising those firms aren't enforcing anything when that happens.

Show HN: Open-source database of vendor compliance information (SoC 2/ISO 27001)

https://github.com/getprobo/probo/blob/main/packages/vendors/VENDORS.md

Most compliance companies are spending hours hunting down the same informations, SOC 2 and ISO 27001 certificates, subprocessor lists, BAAs, terms of service, and so on.To make that process easier, I’ve started putting together a maintained, open-source database of vendor compliance details. Right now, the database includes: - Links to vendor compliance certifications (SOC 2, ISO 27001, HIPAA,...

( Read More... | no comments | 2 points | on HN )

Older »