The last requirement in all of the 12 PCI DSS
requirements concerns policies and procedures,
and that's what requirement 1.5 demands.
Simply,
an organization has to have written security policies and any associated
operational procedures or processes as required by PCI DSS.
The policies need to be documented,
they need to be available to anyone who needs to use them,
they need to be kept up to date,
and they also very clearly need to be in use by the organization.
In previous versions of PCI DSS,
this was actually all in requirement 12 at the end.
There was a general overall requirement that said you
must have policies and procedures.
But now,
because it's recognized that different teams are typically
responsible for each of the different requirements,
this mandate for policies and procedures is included
within each requirement separately.
You'll see it at the end of every single requirement we look at.
The QSA will want to review all of these policies and procedures,
and they'll typically ask for these to be sent in advance of an
assessment so they can read them before they come on site.
When the QSA is on site, they'll want to make sure the documents are accessible.
So that means they're going to be looking for them,
for instance,
to be on an intranet rather than being printouts and kept
in the cupboards locked away somewhere.
They're going to interview people who should be aware of and
should be using these policies and procedures.
So they'll ask, where is the policy?
Show me the procedure you follow when you do something.
I know that policies and procedures are boring,
but without them there's no evidence that an
organization intends to comply with PCI DSS.
And honestly, in the event of a data breach,
the lack of policies and procedures is instantly going to put liability
back to the breached entity because they can't demonstrate they have
the intention of complying with the standard by having the necessary
policies and procedures in place.
We're going to finish this module with a short conversation between Jacob
and me about personal firewalls and about policies.
I know you're thinking that there's probably nothing duller than two
QSAs discussing information security policies.
Look,
I promise you we only have this discussion about policies
once in respect of requirement 1.5.
So, for the other 11 PCI DSS requirements,
we're not going to mention them at all.
And honestly, it's not that boring.
After the conversation with Jacob, the next module looks at requirement 2,
which is another infrastructure-focused requirement,
but this time looking at systems,
how systems in the cardholder data environment are
built and configured to be secure.