hn • r/hackernews
Comment on: FIPS 140-3 is not a security guarantee, and auditors know it
> Track the lifecycle, not the purchase.In my experience this is the core issue with security. It has to be a continuous process in reality but its hard to justify the cost and resource allocation. For this reason it ends up being a point in time function leaving gaps over the life cycle of the product.