I'd also prefer to see these standards go away. I haven't seen any proof they are providing meaningful security at any company I've been at and several of them have had massive hacks despite being SOC2 on paper. They also eat up InfoSec time instead of being productive on meaningful stuff like "Hey, are patching everything?"
Most of these compliance just seem like barber licenses. A way for existing entities entrench themselves.
Most of these compliance just seem like barber licenses. A way for existing entities entrench themselves.