• 0 Posts
  • 94 Comments
Joined 1 year ago
cake
Cake day: August 3rd, 2023

help-circle





  • It has been a few years, but I was once asked to implement 800-171. The document was aggressively vague and really the sort of thing that requires hiring a consultant to setup and probably at least one FTE to maintain. Thankfully our project was abandoned before I had to start looking for other employment just get away from the damn thing.

    So I emphasize with Georgia Tech for not perfectly implementing the rules to the governments confusing standards.

    However, the researchers refusal to run anti-virus even when required by the contract was just stupid. “Academic freedom” doesn’t mean anything when your grants are revoked or you get sued for millions over a breach. That said, they should have been able to work out some sort of “compensating control” to use instead of anti-virus and get that approved by the government.