▲ 2 r/soc2
Nobody warned me the worst part of penetration testing for SOC 2 starts after the report lands
everyone talks about choosing the pen test firm, defining scope and getting the test done. I'm starting to think that's the easy half.
the report lands and now one finding is in the PDF, remediation is in Jira, somebody has a question for the tester over email, the retest happens later, and then audit time comes around and you need to prove what was fixed and when.
none of those steps are individually difficult. keeping the whole chain intact is where it starts getting stupid.
how are people managing this? especially the flow from finding → owner → remediation → retest → final evidence. are you keeping it in Jira and linking everything back manually, or using something that keeps the pen test workflow connected to the compliance program?
u/FixRmarkaujrjble7915 — 6 days ago