Hacker News Reader

Comment by nathanwallace | Hacker News Reader

That's exactly one of the use cases we are targeting. Beyond the standard benchmarks, Steampipe has a simple HCL + SQL language to write your own controls [1]. It feels like writing Terraform, but is for operational and security controls.

Hope you can give it a try, we'd love your feedback and suggestions!

1 - https://steampipe.io/docs/using-steampipe/writing-controls

View on HN

Hmmm. The stuff for HIPAA isn’t great. If this is meant to actually be of value to covered entities and business associates then NIST CSF (and related) is the benchmark to use.

There are known gaps in HIPAA per OCR. The actual expectation is that entities identify these gaps under the annual risk management mandate thus the more frequently updated NIST is what’s preferred (or even HITRUST…yuck)

https://www.hhs.gov/hipaa/for-professionals/security/nist-se...

Feel free to check out OCRs resolution agreements as well for details. They are all online.

Agree that adding NIST controls would be great - so far we've focused on CIS, PCI and HIPAA.

I haven’t seen many engineers who know the first thing about controls. But it’s literally most of what internal audit, compliance, privacy & risk people do.

How about an export feature from Archer or <name your internal audit tool here> that would save everyone a bunch of time and effort.

The other issue is that most of these client audits are a word or excel doc. Throwing your SOC back at them doesn’t work in most cases.

Reply on news.ycombinator.com