▲ 7 r/soc2
What people don’t see behind vendor security questionnaires is the full-time job of keeping answers current
Every vendor security questionnaire somehow becomes a group project where I own the spreadsheet, chase SMEs, verify stale answers, and explain why last year’s SOC 2 report is not a time machine. We have a library now, but keeping that current is basically its own compliance program. anyone found a sane way to automate the repeat answers without letting old evidence quietly creep back in?
u/Dependent-Dig-4077 — 7 days ago