InstantForum.NET v2.9.0SQLServerCentralhttp://www.sqlservercentral.com/Forums/notifications@sqlservercentral.comSun, 26 May 2013 01:26:48 GMT20http://www.sqlservercentral.com/Forums/Topic166443-59-1.aspxExactly. Auditors seek evidence that you have valid procedures. Depending on the audit, they may not seek evidence you're actually following them. Also, even though you have it documented, that doesn't mean you're doing it. That's a key point. Sometimes a pair of eyeballs and a pen test is what is needed to verify everyone is keeping the organization safe. Independent auditors are an essential part of any organization's security posture. They aren't the only part, however.Mon, 21 Mar 2005 09:10:00 GMTK. Brian Kelleyhttp://www.sqlservercentral.com/Forums/Topic166443-59-1.aspxExcellent article Brian, and one which applied equally to sysadmins and security managers. Highlights too the failings of auditors, who all too often seem to only be after ticks in boxes to obtain paper compliance, rather than really testing that the procedures that are in place actually work. Should be required reading for anyone who runs a business that relies on IT.Mon, 21 Mar 2005 02:03:00 GMTJonrhttp://www.sqlservercentral.com/Forums/Topic166443-59-1.aspxComments posted to this topic are about the content posted at <A HREF="http://www.sqlservercentral.com/columnists/bkelley/securingsqlbackups.asp">http://www.sqlservercentral.com/columnists/bkelley/securingsqlbackups.asp</A>Tue, 08 Mar 2005 22:40:00 GMTK. Brian Kelley