My org is in a position where we'll need to get SOC II or ISO 27001 certified in the next year. I've been doing some research on the easiest way to go about this, and discovered secureframe (https://secureframe.com/). It looks like it is a platform that helps you automate/track some of the compliance tasks, but doesn't actually do the audit (they have partners that work through the platform). I'm wondering if... Source: over 1 year ago

Hi, founder of Secureframe (https://secureframe.com) here. Secureframe helps streamline compliance across SOC 2, ISO 27001, HIPAA, PCI DSS, and more. There are so many accurate responses in this thread. Like many have mentioned, SOC 2 is indeed not a prescriptive framework. Much of the confusion behind SOC 2 stems from that fact. It allows you to customize your InfoSec program to your company's needs. As we know,... - Source: Hacker News / over 2 years ago

There is a word filter you can set up, if you have better ideas or something that exists on reddit submit an issue here , maybe set up a bounty on rysolv or donate because I worry they won't have the resources to handle all this popularity. Source: about 1 year ago

In my opinion it isn't marketed well, if a highly popular project will have a link to rysolv on it's website and github page it could get a decent amount of contributions and iirc there was at least one big project that was funded using bounties. Source: about 1 year ago

Better to ask in the community of the implementation, and the best option is probably a bug tracker (adding a bounty on a platform like rysolv could also help). Source: over 1 year ago

A while ago I went over these types of platforms, the best IMO is rysolv. Source: over 1 year ago

Rysolv can also show the most funded issues on the platform and per project (and is last I checked the best open source platform for bounties), it can also be a "low cost" improvement, all you need to do is link to it on the KDE website or the readme of some projects. Source: over 1 year ago