[Info-vax] New VSI Roadmap (yipee!)

[lists at openmailbox.org]

> > If a med-large company does not have a role assigned to develop
> > security policy and another role assigned to implement/monitor that
> > policy, then that is a canoe floating down the river without a paddle
> > heading for the some rapidly approaching falls.
> 
> That's your opinion.  Perhaps not everyone would agree.

This is quickly becoming a regulatory compliance issue like when the
"Personnel Department" became "Human Resources" so they could file all
those federal reports on hiring women, people of color, etc. Look at any
major job site like Dice, Monster, etc. and you will see a huge number of
brand new jobs advertised by every bank and some major companies in retail
and other sectors for many different security positions. The days of hoping
it doesn't happen to you are over.

> Wonder why the government isn't passing laws to force software companies 
> to meet some minimum standards?

They don't have to pass laws. They can legislate through the executive i.e.
make policy requirements and they can and do tailor the "legal" system to
punish companies who don't do what they want- and there is nothing new in
any of this.