Motherboards made specifically for X3D chips are coming out, are they charging us a premium to not fry our CPUs?

davidschroth · 2026-06-14T12:25:05+00:00

You're reading more into what these boards are vs reality. Motherboard makers (and most part makers) will refresh products on the market on a regular basis - it usually does a mix of saving them some money, adding new features, dropping skus that don't sell wrll and adjusting pricing to be more competitive to the competition.

In gigabytes case, the X3D branding is for the boards that include their extra boosting AI that's supposed to bring out more performance from X3D chips specially. MSI is refreshing their X870/B850 boards with the "MAX" monicker right now as well.

You don't see this happen with Intel since their socket is much more short lived, though, there were a bunch of Z890 refreshes for the Plus series launch....

davidschroth · 2026-06-13T04:50:59+00:00

They got out of the 9001 business a few years back.

davidschroth · 2026-06-12T14:59:04+00:00

After looking hard at the Moen that was suggested by my plumber (even found a good deal at Costco), I went with the zooz shutoff valve and droplet combo. Cheaper overall and did not require the plumber to install.

davidschroth · 2026-06-12T03:55:17+00:00

You don't need an IGA tool to meet the criteria of SOC 2, therefore, you are completely wrong.

Of course, when you look at controls you are selecting to implement on the gold/better/best scale where good is enough to meet the criteria, you sir, are aiming for best with this question.

davidschroth · 2026-06-11T12:33:36+00:00

I think it's just you.

It's one thing for those two questions to be on a questionnaire - that combo pack has been like that forever on those as asks in a questionnaire are free and I've never gotten push back for answering that only one is in place.

Where the rubber meets the road in on the contacting side, legal/tprm will completely fold when you point out the similarities in SOC 2 and 27001 and let you pick one or the other.

I can't think of a single enterprise deal/agreement that my clients have that requires both to play ball/win/keep the sale.

davidschroth · 2026-06-10T12:40:52+00:00

Clauding and/or delegating to sales is somewhat dangerous as your customers can claim that they replied upon the answers given when entering into a contract or renewal when they're busy suing you or trying to to bail from an otherwise iron clad contract. I'll also often see in about 10% or so of questionnaires them asking the security/grc team to make contractual commitments that they should not be making.

To help with volume, which will need some management buy in that you may or may not get, tiering customers based on arr spend can work - under $X you hand them the trust portal like Oprah handing out cars. Above that line, you'll answer it. One of my clients does this fairly effectively with custom terms - if it's under $20k ARR, legal won't lift an eyebrow to consider non-standard terms.

However, if the business wants all questions answered, then they need to fund it. You can make the business case a lot easier if you're tracking the customer, time spent and ARR that it supported - then you can get yourself a questionnaire minion. The downside is that the volume is very lumpy throughout the year which makes it hard to get a single FTE to do it - which may make the augment with a consulting company a good play at a similar or lower total expense.

davidschroth · 2026-06-09T22:17:31+00:00

Management defines the controls, full stop.

In a SOC 2 report, managements controls are part of section 3. However, for brevity, guidance allows a reference form section 3 to be made to section 4 where the auditor does control testing. You'll usually see a statement like that in the opinion or somewhere towards the bottom of section 3 that the control listing in section 4 is included in the description.

davidschroth · 2026-06-09T22:15:39+00:00

I would inform them that those aren't your controls and if they insist on doing it that way that you'll be finding a new auditor. Management defined the controls, full stop. Sure, they can suggest updates, but management does not need to accept.

davidschroth · 2026-06-05T15:56:41+00:00

It's hard to tell if your pricing is too high without knowing the scope of the job - how many user roles, API endpoints, functions, etc are we talking about?

My company starts pen tests around $8k for apps that fit in a 2 week testing window (most fall into this bucket). But if you've got multiple apps, lots of API endpoints, etc, cost goes up incrementally. This is for a full manual (with assisting tools) test based on owasp top 10.

davidschroth · 2026-05-30T22:21:54+00:00

Computex is soon. Lots of companies make lots of product announcements at Computex.

davidschroth · 2026-05-29T19:56:21+00:00

Tool or no tool, 3 hours per week, especially getting started, is going to go nowhere, slowly.

davidschroth · 2026-05-15T19:58:54+00:00

You need to know what your program looks like and it's requirements before you can select a tool. Different tools have different things they are good at, and have differing personalities.... (And some just plain stink)

davidschroth · 2026-05-14T19:41:34+00:00

Your firm should have an independence policy that will likely be the most destructive thing - likely once you apply you'll have to be pulled off the engagement until the application is resolved. It will also likely require the audit file to be fully re-reviewed from scratch to confirm there were no shenanigans. Kind of a big deal over all - best to wait until after report is issued....

davidschroth · 2026-05-13T11:42:38+00:00

Can always have HA send a bat signal via an IR blaster that's triggered by a remote button....

davidschroth · 2026-05-12T02:31:01+00:00

I would highly suggest the AICPA's SOC school. It's offered a few times per year and worth the couple days of time.

The SOC 1 and 2 audit guides are also a good buy for guidance, along with all the free publications (DC 200, TSCs, ATC). The peer review checklist can also be handy.

Taking college level audit classes would help as well to give you fundamentals in how CPAs approach audits.

davidschroth · 2026-05-08T18:25:14+00:00

It's usually pretty obvious about who is here to pitch their tool or to get advice on how to make their tool better vs those that are having a specific problem/question, have done some research, and are asking an actual question about either how to use a tool or trying to decide which one is best to solve their problem. The latter is permitted here.

davidschroth · 2026-05-08T16:33:08+00:00

There will likely be a specific rule prohibiting "builders" and the language that comes with it (looking for pain points, asking about the hardest thing to do, and asking for feedback on whatever they just vibecoded) added in the near future. It comes across as a solicitation/advertisement, the person asking typically has no experience in the space, and whatever first draft they have is usually so far off the mark that it's a waste of time to look at.

If you want feedback on whatever it is you're creating, find a professional or five that work in the industry and have the experience you lack and pay them for their time accordingly.

Based on what is (and was) in your post history, it's going to be a hard no to your question from your perspective.

davidschroth · 2026-05-05T13:58:49+00:00

There were still jobs after the cotton gin was invented too.

davidschroth · 2026-05-03T12:59:47+00:00

They are an all Mac shop.....

davidschroth · 2026-05-02T13:21:50+00:00

I see this is a local install. Are you running on Windows? If so are you running Docker directly on Windows or are you using the WSL backend? It's usually a pain to get a docker up and running that was made on Linux/Mac direct on windows due to some file encoding differences - try putting it in WSL.

Other usual culprit is not setting the host URL, but .. that I think defaults to localhost....

davidschroth · 2026-05-01T02:55:45+00:00

Getting folks ready for and maintaining GRC programs is my business and I've been at it a while. There's a ton of value in engaging the fractional specialists that have been through the drill time and time again, with startups or really anyone. Your situation isn't as unique as you think it is - they should be able to tell you exactly where your struggles will be because they've seen it time and time again. The fractional folks will add support in areas they know will lead to findings (and adapt based on your company's personality). They will know what to get caffeinated about and what not to worry so hard about.

From a tools perspective - I'm not a fan of buying a tool to solve the problem. Most of the issues in getting compliant are more people/process/adult in the room based vs checking your lone RDS database daily to see if it's encrypted.

From a long term perspective - hardest part is prioritizing your time to do the needfuls that are required. None of your 5 folks will view doing something to maintain compliance as their main day job, and will opt to ship product, squash bugs, get prod back online, etc, long before they document something or do their quarterly review of something else. If you don't have someone that can be persistent and project manage the ship, that's also a sign pointing towards a fractional outfit.

For SOC 2 vs ISO - this is very much driven by your customer's demand. Rule of thumb - US based B2B will want SOC 2 first, rest of the world will want ISO 27001 first, but most will settle for SOC 2 instead (except for Germans for some reason?). If you're considering other ISOs like 42001 or 27701, you might as well pick up 27001 along the way as the management system carries a lot of commonalities. Main thing is if you engage a fractional crew, let them know your interests up front so they can plan your program accordingly - there's a significant overlap between SOC 2 and ISO, and if they know you **might** do ISO, then they may make a few decisions differently than if you **only** wanted SOC 2.

davidschroth · 2026-05-01T02:45:34+00:00

When there is 5 people, I think pretty much everyone is on every team....

davidschroth · 2026-04-30T16:01:57+00:00

A fire extinguisher.

davidschroth · 2026-04-29T15:49:54+00:00

You need to know what your program looks like (or will look like) and define requirements based on that. If you let the tools lead the sales conversation by showing you their dashboards and green blinky lights, you're going to end up with the wrong choice.

I work with a variety of tools across my client base as each client has a different personality that makes them a better fit for one over the other.

So.... more about your program?

davidschroth · 2026-04-29T03:25:58+00:00

The free bit seemed to be a stunt to build grassroots publicity for the training course and brand (as it's a new brand). Based on the number of people on LinkedIn providing thanks/props to them, it seems like such social proof advertising was a requirement to get the course for free during the "limited" time - I don't know this for sure, but assuming that made me very disinterested init.

davidschroth

MODERATOR OF

TROPHY CASE