u/NarrowSwimmer3012

Been in GRC long enough to see this pattern repeat: org runs the annual IR tabletop, checks the box for SOC 2 / ISO 27001 / cyber insurance, auditor signs off, everyone moves on.

The audit evidence exists. Whether the org would actually handle an incident well is a completely separate, unanswered question.

NIST SP 800-61r3 pushes harder on this. It wants evidence of tested capability, not just documented process. But most orgs I've worked with treat "documented" and "tested" as interchangeable because the tabletop technically checks both boxes on paper.

How are you distinguishing compliance evidence from actual readiness evidence in your programs? Has anyone cracked separating "we can show the auditor a report" from "we know this would work"?

Darkwood proves you don't need cheap jump scares or flashy 3D graphics to create peak psychological horror. The writing and lore surrounding the creeping, suffocating forest consuming 1980s Poland is deeply unsettling. Every strange NPC you meet from the tragic Wolfman to the Doctor presents morally grey choices with genuine consequences. Sitting in a boarded up hideout at night while listening to unseen things bang on your barricades creates an atmosphere very few games ever match. It's a storytelling gem that deserves way more mainstream recognition.