[Autogenerated] requirement nine then.
And if you're an I t.
Person,
I mean Requirement nine is probably the most boring requirement
cause it's about physical controls of things is and I've seen
some wild interpretations here.
You know,
like I've seen a que se se to a retail environment that
everyone coming into the store out to sign the visitor's
bill like consumer shoppers is like.
That's insane, isn't it?
It might just merely be ______, Okay, But it's not good.
It's not good.
Now the standard doesn't require that.
So why?
Why is it you think assessors often go road was requirement
not most weird things with I don't know.
I don't know.
I've got a similar story where a client came to me and they were client
for many years and is that their previous assessor wanted to fail them in
requirement nine because they didn't have.
They didn't create backup tapes, they didn't have removable media,
they just had site to site back up between two sites and well,
you don't have tapes, so I have to fail these requirements about tapes.
But we don't need tapes like that.
The requirements talk about having a process for managing your
tapes and you don't have any of these processes.
We don't have backup tapes, right?
Right.
And sort of round and round.
They went,
uh and so I guess I don't know why assessors or some assessors fixate on the
really sort of tikkun bits of requirement nine and sort of worry them to
death in ways that error detrimental to everybody.
I guess I don't know how to figure out motivations for that, but that does.
That does crop up.
Um, and And requirement nine, you know,
really has a lot of opportunity to say Here are aspects of
this that aren't relevant because we don't have these
physical security risk characteristics, right?
We never print out cardholders, right?
So we don't need a process for destroying, right?
Right.
And at most, in a situation like that,
you want a policy statement that says don't over print out cardholder data,
right?
Don't do it because we don't have a process for we don't have a use for it,
and we don't have a process for it, so don't do it,
okay?
And that would be a very easy way to sort of curtail that.
So what advice would you give to someone who's got a physical,
control fixated type of USA because it happens,
it will frequently, then right then, either was want to to absolutely right.
I mean, apart from find a new QoS a right,
uh,
maybe try to have the discussion about let's figure
out the intent of this requirement, right?
And And if we have obviated the intent or obviated the
concern because we don't have paper media,
we don't have backup tapes or what have you then then
that you know that that's that, right?
That's why there's a not app clickable, you know,
option for requirements in the PC IDE s s.