[Autogenerated] CCTV or whatever Access control is used
because it doesn't say you have to have CCTV,
does it CCTV or badge access?
You know, sort of individually identifying access mechanism.
Yeah.
Um, obviously, in your app,
there's quite strong privacy laws about recording
people going in and out facilities.
Right.
So, uh, that's something that we need to talk about in in the in the assessment,
which we don't often mention,
which is this way don't do this requirement because of a legal constraints,
right?
This is probably the most common in Europe.
This is probably the most common place I've seen that, right?
Right.
I see the legal constraints sort of show up either for
privacy laws in your app about CCTV footage,
retention or in other parts of the world about what
you could do for background checks, right?
Right.
But yeah,
and that's that's why there is that that feature in the aoc
that that capability to say I didn't do this because the law
prohibits me from doing so.
And yes, local laws supersede PC IDE.
SSH.
Absolutely right.
Despite what your QoS Azure might say to you,
local laws always supersede PC ideas, right?
It's written in the standard.
And that's why there is that tick box well,
and they tell us that in QoS a training.
So if you're QoS, Azure is saying no PC IDE nested supersedes local laws.
I've had QoS iOS app, CLI do says is the law,
which, of course, it's not,
although occasionally some laws sort of borrow some
of the language from the CSS.
But yeah, it's not okay.
It is actually where we are today, isn't it?
Because we're in Nevada and I think it's a state law in Nevada.
It might be.
I think it's a statement.
There's certainly a few US states where it says if you handle cardholder data,
you should comply with the right.
So any tips and shortcuts and getting through through
the physical bits of requirement nine.
So if you are outsourcing any of your sort of physical
security stuff to a co location,
facility or cloud provider or something like that,
look for some sort of responsibilities matrix,
um, sort of division of responsibilities matrix,
right?
The provider does this stuff.
The client does this other stuff,
and here maybe the joint responsibilities and make sure
that that aligns with what you expect right and make sure
that that aligns with what?
They're a O.
C.
Says they got tested right as part of their assessment.
Eso you say all my stuff is in Colo's.
I don't have any data centers.
Um, I wouldn't call, you know, the big chunk of requirement nine not applicable.
I would say it's in place,
and here is the AOC that substantiate that my
third-party is holding up their end.