Embed Notice

@wolf480pl @domi @lanodan The answer, as always, is "it depends".

Basically it depends on the people implementing compliance. If they care, compliance and security are aligned. You can use most compliance tools to make life of your SoC easier. Like you wrote before - you can decide on dev teams' priorities, you can learn about practices in other places etc.

But also you can do the absolute minimum to pass an audit and fight with people who discover actual issues outside the approved process.