New answers tagged

2

There are tools to make builds deterministic. However it is not as simple as picking the correct language and compiler. You also have to eliminate all sources of non-determinism from the build. This mostly consists of time stamps and check sums. See https://reproducible-builds.org/docs/deterministic-build-systems/ for a more complete list of non-determinism. ...


1

Yes, it's possible. For example, I have several clients that used an assurance report such as an ISAE 3000 to get some assurance over their alignment with the ISO 27001 standard. But note that this is not a certification. The scope will be among the first things your auditor will look at. If they think the scope is not adequate, they will report it to you ...


3

Certification by accreditation bodies only occurs if you are indeed compliant within the scope you have set for your company. You can request ISO27001 auditors to perform a gap assessment and current state and they can do low or high level recommendations to improve your ISMS or assist with implementation. Note that depending on the amount of advise given ...


7

The Information Commissioner's Office is the relevant public body. You can report a concern online. However, there is no explicit requirement to hash passwords. The Data Protection Act includes eight data protection principles; number is 7: Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of ...



Top 50 recent answers are included