You're viewing a single thread.
It's funny because the audit process for FedRAMP approval businesses is an absolute nightmare.
What’s a FedRAMP?
It's the authorization a company has to have before their systems can access/store federal government data.
The National Institute of Standards and Technology (NIST) has the 800-53 which is a ~500 page document that's just a list of controls that must be followed, and companies have to get audited once a year to make sure they complied with the controls the previous year.
The fun part is that most of the controls are worded super vaguely, and you're at the mercy of the auditor's interpretation of them.
I know one of the people who is an author of 800-53.
It was funny since an auditor was arguing with her. The auditor said I know this better than you do.
She replied back, I wrote it then showed her named in the credits.
That's pretty great. I had to go full Karen on our auditors to speak to their supervisors because apparently the NIST definition of a term doesn't matter if the auditor feels differently. And it was actually an unambiguous definition.
The worst part is the auditor still claimed they knew it better than the person who wrote it.
We got them removed as that’s a level of arrogance that can’t be tolerated.
What does this auditor gig pay?
I would assume six figures. They were an outside audit firm.