Compliance Teams Catching Vendor Data Errors
Compliance professionals are experiencing a recurring issue of inconsistent data and reporting from vendors, specifically in identity verification and IT asset disposal. This necessitates frequent audits and creates friction in maintaining compliance standards. The lack of clear documentation and broken handoffs between teams further exacerbates the problem.
SOURCES (60)
“We have restored computer objects where the object was deleted because the computer had been offline for a long time. In those (very few) cases, restoring the object kept the trust. Normally we would just readd the computer to the domain if the local administrator…”
“I run a consultancy where I often file AppExchange support tickets on behalf of ISV clients, which means I have a dataset on partner support that I don't think anyone else has. After the latest multi-week case, I went back and audited all of them. The numbers: ~50 cases, 500+ combined days of open case time 77 different support reps touched them Average case: 11 days. Longest: 171 days Most were platform issues. Nothing the partner could work around Heavily clustered on search, test drive, a”
“i genuinely would have a central DB as a source of truth, then pipelines to several other ones that would feed through based on permissions & pii etc. so although you have ONE central DB - no one has access to it - especially not developers and each regularly updated DB has the minimum information and permissions for people or chatbots to do their job”
“What slows it down is the data section where our data resides, can it leave our env plus nobody on their side wantint to own pushing a new vendor thru. Having a short security overview doc ready (data flow+sotrage+access controls) speed that up more than expected tbh. the bigger prblem if deals keep stalling on data residency is running the product inside customers own cloud so their data never leaves, this indeed kills a big chunk of scary question and people do it with terraform+ cross account”
“Neither of those options will really do anything... (you can block it completely with CASB) and purview is missing just about every feature.”
“I have all of this luckily, well detailed on the site. I definitely can push harder for this on sales calls though. Only waiting on NDR sigs from a few other places before I would say I am SOC2 ready. And proof of my own data retention policies are available at request for any paying customer. Ephemeral containers, no mechanism for storage outside of numerical and internal identifiers. And AI is used sparingly, and never in the same location as customers sensitive data. Only our learnings from i”
“My background is in data migration which somewhat overlaps with governance but not in great detail I have been developing a version 1 of a data governance application. In essence, it scans your systems via Database connectors/APIs flagging data that does not match your SQL validation rules. These flags are emailed to Team A. If not resolved in x number of days, it is escalated to the Governance Team. Is there any glaring features or processes I am missing? submitted by /u/mahoganyBea”
“That average slippage idea is something I hadn't considered, and it might be the most practical way to frame it without the full picture yet. My worry is they'll fixate on the theoretical number and treat it as confirmed before we even finish the assessment. Some stakeholders just do that no matter how many caveats you add.”
“last mail from our compliance strictly said all data stays on our servers. nothing leaves. a strict requirement. so now my team is the one who has to go find a llmops platform that actually works on our infrastructure. so i went looking… and after surfing a few names i found out that every llmops platform is saas first. almost each one of them . sign up then dashboard. your prompt and trace and eval go to their server. it might be fine before but not fine fine for us now. our data cannot go to t”
“Hey everyone. My team and I have been building hardware, and managing the regulatory compliance and technical documentation (especially around wireless frameworks like FCC/CE) has been a massive bottleneck. In the past, we'd get late into a design cycle only to find a regulatory conflict that cost us weeks of rework. We got so tired of this that we ended up building an internal tool to automate the technical docs and flag regulatory conflicts before we even start prototyping. We are thinking”
“Report it as it happened this week lmao. What else you can do if your report comes in 5 days later? Unless there's is a mitigation to get it faster, or any predictive work is possible, then there is no other way. Act like each report is new, and react based on it?”
“That`s a mistake actually. Not the audit part, which i totally agree with. Audits aint enough. You should look more broader. You should check the CORE3, its far beyond surfacing volume and liqudity. It measures risk across 6 different domains, even checking the reputation of leaders. I could share a methodology of this, if you like to know more.”
“A reusable evidence pack would cut the avoidable part: normalized filenames, a one-page index for owners and directors, and a dated change log. Each institution can still run its own checks, but you stop rebuilding the packet from scratch.”
“Worth noting that most security checklists people run (audit reports, TVL, time in market) are backward looking, they tell you what's been reviewed, not what's currently exposed. The Ostium case looks like a compromised key or privileged access issue rather than a smart contract bug, which is a different failure mode entirely and one that audits don't really test for. That distinction matters because a protocol can have a clean audit history and still have a single point of failure s”
“Spent most of last week digging up the same three documents for the fourth time this year. Cert of incorporation, ownership breakdown, director IDs. Dragging files across folders, drives etc Different bank, same stack of paperwork I've already handed to three other institutions who all verified the exact same facts. And then it hit me that this is completely normal and nobody questions it. Every bank, every fintech, every partner platform runs their own KYB from scratch. They all check the s”
“This is the right framing. The list you described, architecture, documented practices, access control, logging, evidence security is operationalized, is exactly what buyers actually want. SOC 2 is just a way of packaging that evidence so buyers can trust it without doing their own archaeology. We built vauntico.com to generate that evidence layer continuously from live repo signals so founders can share a verified profile before procurement even asks. Might be useful at your stage before committ”
“Checking recent audits is only the start because users should also look at admin keys upgrade permissions bug bounty history and how much value the contracts currently secure..”
“the person list lives with HR Yes, because HR handles personnel, and can gather the required information. the file list lives with the department heads. Yes, because they're the ones that own the data, and therefore know (or should anyway) what's contained in the data, and therefore any status or tags that need to be applied. Who reconciles the two when a specific drawing gets opened? I'm not sure what you're reconciling. If everyone is doing their jobs correctly, the non-authori”
“those two are the most enforced, but ADA and EAA enforcement are no joke either tech insurance is a very serious thing, i'm guessing we're going to see business continuity events that scare investors”
“Hello there. Does any sysadmin / security person have feedback to provide on elestio ? I see they are EU hosted, they have SOC2 / ISO27001 compliance. How their service and support ? More specifically I'd be interested by their vault service. Thanks submitted by /u/baptistemm [link] [comments]”
“But probably should be. IMO the convenience of online updates and config changes is irrelevant compared to the physical harm that could result if compromised. The OT / SCADA networks should be airgapped, with maybe a diode for telemetry output. It's not just things like denial of service attacks on a power grid, look at the Aurora generator test as a demonstration of critical infrastructure being physically harmed via the internet. Or as a real incident, the Maroochy Shire cyberattack where”
“Pretty much this. When our product has a major outage or a specific class of software bugs, our clients miss payroll, which causes huge problems for them and severely damages their trust towards us. Hasn't stopped us from pushing AI adoption at, in my opinion, a reckless pace. We're already beyond the point where the amount of code generated is too high to be both adequately reviewed and adequately tested by our QA department. On the other hand, the quality and quantity of automated test”
“Over the past few months I source-reviewed 200+ self-hostable multi-tenant AI and SaaS tools (the kind a lot of us run here) for one specific bug: an access-control check that's enforced on writes but skipped on the neighboring read, so one tenant, workspace, or user can read another's data. I confirmed it in 78 of them. The pattern was almost always the same. A developer scopes "delete this item" to the tenant, then later adds "view this item" or "list its embed”
“Replit is a real risk here if it'll handle client logins/documents — those quick "vibe-coded" apps usually skip proper authentication and access control, which matters a lot when clients are viewing potentially sensitive drawings/documents. That's not really an optional detail for a client portal. WordPress + a portal plugin can work, but it's often overkill for "just show clients their documents" — you end up paying for and maintaining a full CMS to get one featu”
“Expand the replies to this comment to learn how AI was used in this post/project.”
“the awkward pause is real and it happens more than PMs will admit publicly. the root problem you're describing is that PRDs get written after the conviction has already formed, so there's nothing to trace back because nobody was capturing during the messy part. what you built targets exactly the right moment, the "who actually asked for this" question is the one that kills trust fastest in a room full of engineers. only thing i'd watch: PMs who already feel accountable for”
“I'm curious if this is even an export. Suppose: A person in India has an account. Nothing ITAR regulated is shared with them, if they sign in to SharePoint for example, they do not have permissions to any sites that have ITAR data. However, they are granted the Global Admin role. This doesn't mean they can just view whatever, but they could give themselves the ability to do so . But if they did, it would be audit logged, and even a Global Admin can't tamper with cloud logs. Six month”
“There have only ever been like 800 ITAR disbarments ever, with tens of thousands of ITAR capable entities over the years. Nearly all of the disbarments are statutory and are for specific issues with fake companies or direct ties to foreign intelligence. As an actual "small business" style American company, operating in good faith the likelihood of punishment for various audit failures is minimal. If the company is big enough they have a legal office with knowledge of ITAR developing re”
“The offshore admin through the MSP is the version of this i keep hearing described as a quiet norm, you're the first to name it as an export event outright. Have you seen it actually get caught, by a client audit, a prime, an assessor, or does it just sit there?”
“That might be the most concise answer my whole research project has produced lol. Does it stay that way until something happens, or have you ever watched it become somebody's job after an incident or an audit? Trying to figure out what actually forces the change, because the deadline pressure apparently just got suspended”
“I think some of the criticism here is missing the actual value of what you built. A due diligence tool does not need to replace a full audit to be useful. Its value is in helping people quickly build a structured picture of a protocol before they spend days reading scattered documentation, governance pages, incident reports, audits, admin controls, oracle dependencies, bridges, upgrade mechanisms, and operational assumptions separately. The difficult part is rarely finding one isolated fact. The”
“InfoSec finally let us add an AI notetaker to the approved list after six months of saying no. The thing that finally got it through wasn't the feature set, it was the admin side. We tested Jamie, Fellow and Granola and deployed fellow. Fellow ai holds SOC 2 Type II compliance, exposes a super admin API for audit log access and user provisioning, and enforces retention windows at the workspace level including a zero day option for sensitive teams. Pause and resume recording mid call is also”
“how do you guys prevent abusive audit requests? We get several per month requests for us to upload our materials to yet another vendor management portal Each portal requires the data in their format resulting in dozens of hours of work. I just received a request for several hundred pages of documentation and they want it by Wednesday. It'll take a security team member most of the week for a client that pays us a few hundred dollars per year. Do you guys have some form of throttle in your SLA”
“We had a place drop us because we turned on MFA. After they failed their audit they came crawling back and the boss hit them with a huge onboarding bill. It was very satisfying.”
“For audits/insurance/customer reviews, I would package it as evidence of a control, not just a screenshot of a backup job. A simple evidence set that usually lands well: backup policy: what systems are protected, frequency, retention, encryption, immutability/object lock restore test schedule: monthly file restore, quarterly service/app restore, annual disaster scenario restore ticket for each test: date, system, backup point used, person performing test, steps taken proof of result: restored fi”
“We keep record of anything we ever restored in our ticketing system. So whenever a user deletes a file and needs it restored, we log it. And that's accepted by our accountants. We also have Veeam and with each backup it takes, Veeam checks if that backup is restore-able.”
“With one month, I would split this into "audit survival" and "proper target architecture." Do not try to boil everything at once. For the next 30 days, I would prioritize evidence-producing controls: Asset inventory: every endpoint, owner, OS, encryption state, patch state, local admin state. MFA everywhere you can enforce it quickly: Google Workspace, VPN/admin portals, NAS, network/cloud consoles. Disk encryption: BitLocker/FileVault/Linux equivalent, with recovery keys esc”
“If you haven't tested your backups, you don't have a backup. You have something which might be a backup. is it enough to actually recover from? who knows. not you, because you haven't tested it.”
“If this is CMMC try to use a enclave solution like Preveil gsuite has been audited against CMMC and passed. But a lot of what you need would be easier via GCC High thru MS. We are an MSP Ciegate Technologies that does CMMC and other security frameworks. But it all really depends on scope”
“CMMC got everyone in a mess. Fix all ~300 assessment procedure checks and then make sure everything is documented. Also, hope no one in your org lied in SPRS.”
“So I am currently staring down a massive defence compliance framework audit that hits in exactly one month, and I need a realistic sanity check on our remediation roadmap. We have 30 users and are currently starting from absolute scratch regarding endpoint security controls. The Current Setup is; We are a Google Workspace shop (email, calendar, drive). Everyone currently has local admin rights on their laptops (mostly Windows, a couple of Linux). There is no active centralized directory or MDM c”
“ZDR is not theoretical. It's a standard contracting path that exists today. Anthropic offers zero data retention agreements on the API side, negotiated per organization: prompts and outputs are not stored at rest after the response returns. OpenAI has an equivalent for eligible API endpoints. And if you route through AWS Bedrock or Google Vertex, the model provider never sees your data at all. The cloud provider processes it inside your environment boundary and doesn't retain prompts or”
“One-man IT shop here (EU, ~10 Linux servers, restic to S3 with object lock). Twice this year I've been asked to prove our backups work — once by a cyber-insurance questionnaire, once by a customer's vendor-security review. "We run restic nightly" wasn't accepted; they wanted evidence of tested restores. Genuinely curious how others handle this: Do you do scheduled test restores, or restore only when something breaks? What's your Linux backup stack — restic/borg, an agen”
Then THEY tell you exactly. Our soc was even recommending tools.
“For a failure report, I would want the exact step, action, locator or visual target, screenshot before and after, browser and viewport, console/network errors, timing, and a replayable trace. Separate “the product is broken” from “the test is ambiguous” and “the environment was unavailable.” A short human-readable summary is helpful, but the raw evidence is what lets a developer reproduce the issue and lets a non-technical stakeholder understand whether the failure is real.”
“Interesting approach! The shareable report could be really useful for teams, as well as for clients”
“Sharing this as SHOW IH because I suspect the situation is more common than it looks, which is building something fintech-adjacent with no actual fintech background and trying to find where the real compliance lines are before you ship something you'd have to tear out later. What we're building is a payment module that SMB SaaS tools can embed, basically a Stripe integration layer designed around what an accountant actually needs from an audit trail rather than what a general-purpose pay”
“Been dealing with the thing a lot of people here run into, a carrier's DOT/MC looks clean on FMCSA but the company behind it isn't who they say they are. Stolen or dormant authority, new email, new phone, same scam. Built a scanner that checks a carrier or broker's packet against FMCSA and the Canadian equivalents, flags name, address, phone, and email mismatches, and gives you a straight verdict instead of a pile of raw data. Video below is it actually running on a packet. Not a gua”
“On 1, yes basically. You are not making them get their own certificate, you are binding them in the contract. A DPA plus a security requirements schedule where they commit to your controls, and then you manage them as a supplier: due diligence up front, the requirements written into the agreement, and a periodic check that they are actually meeting them. Your own ISMS carries the risk, which is exactly what the supplier controls (A.5.19 to A.5.22) are there for. On 2, that Layershift style wordi”
“Have any of you tried doing RAID logs directly in Asana? It seems appealing to be able to keep everything in one tool and be able to multi home risks and issues, but I’m wondering if this will come back to bite me vs just keeping my raid log in confluence. For context, this is a new PMO and our leader is interest in doing everything that can be done in Asana all in one tool, but we’re still learning Asana. We’re also considering doing Stakeholder Register/list of team members in Asana. Similar f”
“Hi guys, had to investigate something this week that ended up reaching back further than our retention Nobody had intentionally chosen that number. It was just inherited from years ago because storage wasnt cheap back then. Now I'm wondering if we're being way too aggressive rotating logs, or if this is just one of those things where eventually every retention policy is too short. At what point have you found the extra storage stops paying for itself? submitted by /u/Round-Cl”
“Hey everyone! With the new security issue, our team has put together a short slideshow we are starting to share with our clients. I am making it available for everyone here to refer to for themselves and we are also happy to have feedback if anything we prepared is not 100% accurate. This is a change we can all help each other navigate! Another thing we have been doing is submitting support tickets for every client asking for a 90 day extension for enforcement. I encourage you to do the same! &#”
wcag compliance is always such a headache to track, glad you included that
“Perhaps not strictly sysadmin, but only seeing the logs of your application and nothing else. If the error happens before the user interacts with our app, impossible to investigate as it would require a ticket for the other team and they might look into it after 2 weeks. We also maintained everything previously so we had much more control, now there is some offshore team spinning up databases, firewall rules etc and it takes at least 3 attempts and 2 weeks to get anything right”