As with all of the PCI DSS requirements,
the last sub requirement in requirement 3,
requirement 3.7, is to have documented policies and procedures,
and that the policies and procedures are written down,
people know where to find them and that they're actually being used.
To validate this,
the QSA will want to look at the documentation and will speak
with people who should know the policies and procedures exist
and who should be following them, and you know,
the QSA might randomly ask them, what would you do here,
you know, which the right answer is,
I would look at the policy and procedure to make sure I know what I'm doing.
Right, that's the end of the theoretical part of PCI DSS requirement 3,
looking at the protection of stored cardholder data,
and probably more encryption than you wanted to hear about.
Now it's time to join the conversation I had with
Jacob where we discuss things like, we discuss masking,
we discuss full disk encryption,
and we discuss quite a bit about practical aspects of cryptography.