Serious question. What are you auditing? You have access to all of your code and data and everything else seems like it would be up to your provider.
Wouldn't you know up front when you're choosing a stack whether they meet your compliance demands?
Wouldn't you know up front when you're choosing a stack whether they meet your compliance demands?
The number of actors in industries with particularly notable compliance requirements (like HIPAA) that have internally very weak, inaccurate, ideas of the actual requirements and who discover the pracctical meaning of key elements both long after they've been in force and long after they've relied on an inaccurate understanding is, well, non-negligible.
No, not always. Good luck with the refactor (complete rebuild?) when the time comes.