[Autogenerated] I want to just quickly look at the
standard because there's there's, um,
one of the really interesting thing want to
interesting requirements here is this, um 7.2 on access control system?
Yes, the standards.
Quite vague about what an access control system is.
If you look in the glossary, it doesn't say an active control.
Um, access control system is elder app or Active Directory?
No.
Is that what it means?
I think it can mean that.
And that is very often what organizations take it to mean.
And how how we apply that, how we think about it from an assessment standpoint,
Uh, it could also be, uh, you know, the set of roles in a database,
right?
Or a set of roles or permissions in an application.
Um, Or if you've got maybe a kind of legacy sort of mid range system,
uh, you know, which has very,
very granular access controls and has done a really sort of
fantastic job of that for a very long time.
Uh, you know, it could be something like that.
So you shouldn't think.
Oh,
I don't have The reason I'm bringing this up is that I once
had a client who spent a lot of time, um,
trying to link stuff everything back to IDE,
right?
In some cases, you know,
buying new software to be able to link stuff back to IDE or
changing the way they did stuff because they thought this access
control system meant that they had to have everything linked back
to one access control system.
Yeah, you don't necessarily have to bind it all to Active Directory.
Maybe that makes your life easier.
May.
Or at least maybe you have one place for things to irritate you, right?
As opposed to seven different access control systems that irritate you.
And if that's of benefit, then sure, right.
But but that's not necessarily what the intent of the requirements.
I'm not quite sure what the client was using it to get leverage to do right.
Then CSS requires me to do it like we want you to it for five years, right?
But they spent a lot of time on that, right