Now we come to requirement 2.5,
which is the one that makes sure we have the necessary
documentation to support all of the items in requirement 2.
And remember, this isn't just policies,
but it's also procedures where these are needed.
The QSA is going to look at the documentation,
they're going to talk to the people who should be using it to
make sure they know where the documentation is,
and that they're actually following it.
Now,
I know I said in requirement 1 that the policy and
procedure requirement is always the last requirement of
all of the 12 PCI DSS requirements,
and that's not true in requirement 2 because there's one requirement,
Requirement 2.6, that just applies to shared hosting providers.
A shared hosting provider is a service provider that uses a single system
to provide services typically to multiple merchants,
but to multiple entities that do PCI DSS.
This came into the standard typically because of companies
that offered shared web hosting on a single server for lots
of small e-commerce merchants.
What PCI DSS is trying to achieve here is that the compromise of
one merchant's system on the server doesn't compromise every
other merchant's whose e-commerce store is running on the same
logical or physical server.
So, if you're a shared hosting provider,
you need to turn to the back of the PCI DSS standard and look at Appendix 1,
which contains a large number of additional requirements that your QSA,
when they come to assess you, will look to validate are in place.
So that's the theory of requirement 2.
Now,
let's join the discussion between Jacob and me where we talk about credentials.
We talk about requirement 2 in the cloud and also how you can
reduce the cost of QSA assessment by really helping the
assessor when it comes to validating the configuration and
inventory aspects of requirement 2.