[Autogenerated] coming back to Year two.
So business as usual organizations compliant.
You're coming back.
What do you do the second time around?
What are you looking for in terms off seven.
Requirement seven.
Well, again seven and eight often travel together.
So, uh,
maybe a different sample of user accounts and making sure that
they are assigned sort of the appropriate roles,
uh, or or trying to see if things have changed,
right?
If if there are new systems, new repositories or things have gone away,
maybe Or, you know, we we bought a new company and we threw it into the pot,
or we got rid of some stuff.
How does that change the groupings?
That that's usually the interesting stuff in year two.
Otherwise, if you've done it right in your one and it stays pretty constant,
then yeah, stays pretty constant.
Um, now,
what about causes of compromise requirement seven major cause of compromise.
Again, I think this goes into the pile of not the cause off,
but the thing that makes it worse.
I mean,
the one thing I thinking back to when I read forensic reports
the one thing I really concentrating on,
something you said earlier.
Too many administrators on one of those administrators
has left and already noticed that left.
And then the bad guy used the administrator because you have a lot
of administrators hard to keep control of that.
Yeah.
Luckily, and requirement eight.
Now, we have multi factor authentication for administrators,
which we're gonna come onto in a few minutes,
so that should hopefully take that away.
But, you know, I've done security audits.
Where you you run up the tool and you look at how many admits there are.
You go.
It's gonna be It's gonna be a long week.
This is gonna get rough.
Yeah.
Um, I'm compensating controls and any common uses of compensating controls.
I don't see a lot of compensating controls for requirements.
Seven.
Yeah, It's a little bread and butter, isn't it?
Is right.
Like I don't know what you would compensate like you either
have access controls or everything's on.
You know, yellow legal pads, I guess.
Um so that seems pretty simple.
Requirements seven.
Short requirement.
Business as usual.
I t.
And look after administrators on the number of administrators you have.
It is about wrapping it up.
It is.
It's important but it's relatively straightforward.
Okay, well, we'll finish requirements in their and then we'll look at,
as you say, that in the next module is requirement,
which is very closely aligned.
But it's like how How do we get those users on boarded onto
the network in into systems on How do we make sure that the
right user a gzip in every time, right?